authz-policy and rootDSE