one of the big items to note about any policy engine is that it will make the "acl aware index" problem much harder, because policy can filter based on pretty much any criteria