keep policy in api, not db