trying new way to do access policy logic