policy default deny
allow	*	*	foo=bar	*