correct is s2s_policy, not s2s_access