a reusable allow policy admitting exactly these addresses
create, or return the one already covering this worker
the app covering this worker, so a second run does not create a duplicate
a reusable allow policy admitting exactly these addresses