How to add a condition for password-protected attachment to a policy