Read policy, you need scan face to verify