creation_permission policy refactor