When adding a single file or directory, autorun is used. We should warn if the added policy files do not have autorun tag:
Or maybe do this automatically?
Currently the "directory" build step will auto-include the policy in inputs, but not bundles. So the policy will be evaluated but not activated unless the autorun tag is present.