I reopen this because we also need a content policy for the usage phase, only the generation phase is covered for now. During the usage phase the security check is bypassed on the "FLEXIBLE_REPORT" contentId