o moving blacklisting up and out of the repository itself o remove magic policy creation in the artifact implementation, it's already done in the request populator