Restrict policy profile access to tenants

Icehouse port