Merge in policy permissions if they are present and the appropriate flag is set