text: First, notice there is no Principal element in the policy. This is because attaching a policy to a 
  principal implicitly speciﬁes the principal to which the policy applies. Policies can exist apart from 
  
  principals, so that common policies can be re-used for many roles, services, etc. 