Refactor update visible_to to use policy scopes

This solves the problem with Postgres DeadLook that some times happen on specs.