As you see, I cannot check that the application is defined, as AccessPolicy only gets the human_user portion of ApiUser.