hey! thanks - it is only a property of the caller now, where the policy would say allow the list of apps with foo/us-east-1/test, bar/us-west-2/dev