policy-based-auth posts