expect policy to be called in controller