in builtin chains, always emit a custom default policy rule