Policies, agents, and enforcement cost nothing. The paid tier is for card volume, not for permission to have rules.