code: function (policy) {
              // Recursively normalize lists of policies
              if (_.isArray(policy)) {
                  // Normalize each policy in the chain
                  return _.flatten(
                      _.map(policy, function normalize_each_policy (policy) {
                          return policyHookDef.normalizePolicy(policy);
                      }));
              }
  
              // Look up the policy in the policy registry
              if (_.isString(policy)) {
                  var policyFn = this.lookupFn(policy, 'config.policies');
                  // Set the "policy" key on the policy function to the policy name, for debugging
                  policyFn._middlewareType = 'POLICY: '+policy;
                  return [policyFn];
              }
  
              /**
               * This line was added to support auto building of policies
               */
              if (_.isObject(policy) && policy.build) {
                  policy = policy.build();
              }
  
              // An explicitly defined, anonymous policy middleware can be directly attached
              if (_.isFunction(policy)) {
                  var anonymousPolicy = policy.bind({ });
                  // Set the "policy" key on the function name (if any) for debugging
                  anonymousPolicy._middlewareType = 'POLICY: '+ (anonymousPolicy.name || 'anonymous');
                  return [anonymousPolicy];
              }
  
              // A false or null policy means NEVER allow any requests
              if (policy === false || policy === null) {
                  var neverAllow = function neverAllow (req, res, next) {
                      res.send(403);
                  };
                  neverAllow._middlewareType = 'POLICY: neverAllow';
                  return [neverAllow];
              }
  
              // A true policy means ALWAYS allow requests
              if (policy === true) {
                  var alwaysAllow = function alwaysAllow (req, res, next) {
                      next();
                  };
                  alwaysAllow._middlewareType  = 'POLICY: alwaysAllow';
                  return [alwaysAllow];
              }
  
              // If we made it here, the policy is invalid
              sails.log.error('Cannot map invalid policy: ', policy);
              return [function(req, res) {
                  throw new Error('Invalid policy: ' + policy);
              }];
          }
docs: Convert a single policy into shallow array notation
  (look up string policies using middleware in this hook)
  
  @param {Array|String|Function|Boolean} policy
  @api private