refactoring how access policy is handled