So then, i guess, mixing up the two somehow might be a good solution for my use case. User defined policies, injected with graph data inside the policy decision engine