Discussed in this thread:
Policy does not get applied recursively on itself. This shows up in situations like:
A customer has many orders
An order has one customer.
Get the customer from the database.
In this scenario, the expectation would be that the customer has a list of orders, each order has a customer, and then the order's customer also has a list of orders.
Due to the way policy is implemented policy is only applied 2-deep.