Because it has to be executed for policies without configuration, it needs to be executed on the module level, not instance.