Access policies not enforced