[POLICY] Remove hardcoded credentials from policy-api