Added subtenant policy construction, first attempt