create policy using attributes controller