In what order are filtering policies applied?