Configuring credential policies