Make policy optional. Let internal handle validation.