writing queries for retrieving policies for authenticated users