RLS - update with default deny policy, still needs to be put in right location.