added @user declaration to policy so role cannot but nil