nanny: reject policies with invalid name