block user access on polices