Reading policies via URLs instead of file paths