Optionally disable authorization via policy