UserPolicy spec