8.7 Risk-based Policies