[Policy] Remove hardcoded credentials from pap