Add :except in security_policy