Fixed policy for security-service create