. "In addition, the policy may also govern how messages are to be treated in response to characteristics other than the security token." . . .