Apply policy to pre-authenticated user