a shipped role template's data policy is read-only; clone the template and set the clone's
set_data_policy
