Step 8 – restriction-based policies