Add hasDeny field to Policy (#179)