7.7 Risk-based Policies