enable policy-only domains (no rules, just policy declarations)