Can custom attributes be used in an exception rule in a policy?