Add missing policy specs for `internal` users

The following discussion from !28071 (merged) should be addressed: