12. Policy scan