initial xlock policy
    a bit messy (kind of depends on usersubject)