Utilize security policy

[hectorsector]

The learner is currently asked to create a security policy, but we don't use it. The immediate next step (which is an alert about sensitive data) is a perfect opportunity to close the loop on the inclusion of the policy and how to use it.