use policies to control authentication