using policy objects in query and scan