Add policy for User resource.