What is one component that the administrator must create before the policy?