Add Evident RO IAM policy without ability to get data