embed policies in users and skip properties when doing so