policy: Add a deny-all policy as an example