external-checkpolicy