tests: use real policies instead of mock dummy policies
    
    This lets us refactor how the policies are represented, stored, and
    evaluated without having to rewrite every test.