add on_whoami to policies