question  do we want to end up having an empty almost empty fake policy file  i am asking because what this fake policy file is doing  is making some of the apis looser in terms of authorization  for testing purposes  if we will remove all these rules  we would have to have an admin context for almost all tests 