getPolicy is privileged