policy: Add a new policy hook to restrict access to private extensions