How does the Discover Scanner run policies against scanned data?