Currently, PATs do not have their own policy.
To implement API actions in a future MR,
this MR adds a policy to be used by this
and future developments.