Couldn't you remove this `resource.new_record?` somehow? Maybe moving its logic to the policy definition. It's ugly and complex to maintain having these `if`'s for each input.