create a new kind of remote schema for policy objects
ResolvedUser objects are responsible for finding their own matching policy objects
writing queries for retrieving policies for anon users (including those identified by IP4 address range)