Refactor Policy Mechanism out of Operation and Models

[catmando]

Currently its scattered between operations and models and a pretty weird way.

[laquereric]

Also,

Following the tutorial is NOT consistent with the default deployment of Application Policy:
"
Note: The hyperstack installer adds a policy that gives full permission to all clients but only in development and test modes. Have a look at app/policies/applicationpolicy if you are interested._
"