refactor the experiment for policy-based authz