should the predefined policies be immutable, and users only allowed to amend additional ones that have been created? I'm not sure how other systems treat this, so I could be talking nonsense. It just seems ripe for assumptions to be made about a group that has been modified