As discussed here, the policy is from outside the org.