Assigning credential policies