When a policy runs, it uses a new worker to allow
it to run without a user.

The policy is only accessible to users with destroy image ability