Encapsulate two-tier policy pattern (bypass + HasPermission). Promote consistency across resource policy definitions.