Risk-based policy management