title: Require authenticated user in asp.net core but require custom policy in some actions require custom policy
body: <p>My Asp.net core site required authentication by default</p>
  
  <pre><code>services.AddMvc(config =&gt;
  {
      //only allow authenticated users
      var policy = new AuthorizationPolicyBuilder()
      .RequireAuthenticatedUser()
      .Build();
  
      config.Filters.Add(new AuthorizeFilter(policy));
  });
  </code></pre>
  
  <p>but for one action I would need to allow anonymous access (/Account/AddUser if there are no users in the database).</p>
  
  <p>I created this custom policy which checks that the user is either authenticated or that the user db is empty.</p>
  
  <pre><code>[Authorize(Policy = "NoUsersInDatabaseOrUserAuthenticated")]
  public IActionResult AddUser()
  {
      return View();
  }
  </code></pre>
  
  <p>There seems to be an AND between the global policy and this so it won't work. If I add [AllowAnonymous] the policy is not evaluated at all.</p>
  
  <p>How can I replace the global policy with a custom policy for one action?</p>