client script vs ui policy