improve test isolation
- factor out policy interface
- test enforcement of arbitrary policy
- separate test for default enforcement