- users should not be able to switch an existing
  policy's type
- they should instead delete the policy and
  create a new one
- abstract out code
- add tests