Specifying a policy for PBR