adding policies to protect apis