add token aware policy spec