policy: Add a deny-all policy as an example

No match.