move dependencies to policy package