policy installation now depends on role of the controller