Security: only one type of Policy in Api and in Resource.