title: overriding an authorization policy in .net core 2 with razor pages
body: <p>I've got a question regarding how authorization policies overlap / get overridden in .net core 2.</p>
  
  <p>Basically, I'd like to set a policy where by default, all pages require admin access, and then have certain sections that are explicitly opened to regular users too. That way any new sections are locked down by default. </p>
  
  <p>So in the services setup section I set the policies:</p>
  
  <pre><code> services.AddAuthorization(options =&gt;
          {
              options.AddPolicy("ValidUser",
                  policy =&gt; policy.RequireClaim("Type"));  //any valid user
              options.AddPolicy("AdministratorsOnly", 
                  policy =&gt; policy.RequireClaim("Type",UserType.Administrator.ToString()));
          });
  </code></pre>
  
  <p>And then the razor pages options:</p>
  
  <pre><code>services.AddMvc()
  .AddRazorPagesOptions(options =&gt;
  {
      options.Conventions.AuthorizeFolder("/","AdministratorsOnly");
  
      options.Conventions.AuthorizeFolder("/UserFolder", "ValidUsers"); 
  
  });
  </code></pre>
  
  <p>But, the ValidUsers policy does not override the blanket AdministratorsOnly policy set above. If I use AllowAnonymousToFolder on /UserFolder, that will negate the Administrators policy, but obviously that isn't what I want.</p>
  
  <p>And if I reverse things and have the blanket policy be ValidUsers and the "override" be AdministratorsOnly, then it works. But again, not what I want.</p>
  
  <p>Is there a way to make this work? The docs are less then helpful in this case. </p>
  
  <p>And yeah, I know I could get where I need to be by having admin folders for admin pages and locking them down that way. Or any number of other methods to ensure security. But for future reference I'd really like to know how policies interact with each other when they overlap like this. </p>