user intent takes precedence over policy