When generating configuration with Dhall it is simpler to specify a policy rather than rewrite a session label.