add policy statement