diff --git a/policy.conf b/policy.conf
new file mode 100644
index 0000000..99f0409
--- /dev/null
+++ b/policy.conf
@@ -0,0 +1,17 @@
+# type	id	name	description	condition	permissions
+
+virtualcollection	WPD15-VC	Wikipedia	Deutsche Wikipedia 2015	public	read
+corpus	WPD15	Wikipedia	Deutsche Wikipedia 2015	public	read
+corpus	GOE	Goethe	Goethe corpus	public	read
+foundry	base	Base	base foundry	public	read
+foundry	dereko	Dereko	dereko foundry	public	read
+foundry	corenlp	CoreNLP	CoreNLP parser	public	read
+foundry	opennlp	OpenNLP	OpenNLP parser	public	read
+foundry	malt	MALT	MALT parser	public	read
+foundry	mdp	mdp	MD Parser	public	read
+foundry	tt	Tree Tagger	Tree Tagger parser	public	read
+layer	s	sentence	sentence	public	read
+layer	c	constituent	constituent	public	read
+layer	d	dependency	dependency	public	read
+layer	p	pos	part of speech	public	read
+layer	l	lemma	lemma	public	read
diff --git a/pom.xml b/pom.xml
index 85e0e3b..56538cc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -103,6 +103,9 @@
                     <include>**/*.info</include>
                     <include>**/*.properties</include>
                 </includes>
+                <excludes>
+                	<exclude>**/ResouceServiceServerTest.java</exclude>
+                </excludes>
             </testResource>
             <testResource>
                 <directory>src/main/resources</directory>
diff --git a/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java b/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java
index f3e3d5c..7255988 100644
--- a/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java
+++ b/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java
@@ -28,17 +28,17 @@
 
     public static final Map<String, Object> KUSTVAKT_USER = new HashMap<>();
 
-    static {
-        KUSTVAKT_USER.put(Attributes.ID, 1000);
-        KUSTVAKT_USER.put(Attributes.USERNAME, "kustvakt");
-        KUSTVAKT_USER.put(Attributes.PASSWORD, "kustvakt2015");
-        KUSTVAKT_USER.put(Attributes.EMAIL, "kustvakt@ids-mannheim.de");
-        KUSTVAKT_USER.put(Attributes.COUNTRY, "Germany");
-        KUSTVAKT_USER.put(Attributes.ADDRESS, "Mannheim");
-        KUSTVAKT_USER.put(Attributes.FIRSTNAME, "Kustvakt");
-        KUSTVAKT_USER.put(Attributes.LASTNAME, "KorAP");
-        KUSTVAKT_USER.put(Attributes.INSTITUTION, "IDS Mannheim");
-    }
+//    static {
+//        KUSTVAKT_USER.put(Attributes.ID, 1000);
+//        KUSTVAKT_USER.put(Attributes.USERNAME, "kustvakt");
+//        KUSTVAKT_USER.put(Attributes.PASSWORD, "kustvakt2015");
+//        KUSTVAKT_USER.put(Attributes.EMAIL, "kustvakt@ids-mannheim.de");
+//        KUSTVAKT_USER.put(Attributes.COUNTRY, "Germany");
+//        KUSTVAKT_USER.put(Attributes.ADDRESS, "Mannheim");
+//        KUSTVAKT_USER.put(Attributes.FIRSTNAME, "Kustvakt");
+//        KUSTVAKT_USER.put(Attributes.LASTNAME, "KorAP");
+//        KUSTVAKT_USER.put(Attributes.INSTITUTION, "IDS Mannheim");
+//    }
 
     private static final Logger jlog = LoggerFactory
             .getLogger(KustvaktConfiguration.class);
@@ -84,9 +84,7 @@
     private String default_dep;
     private String default_const;
     
-    private String defaultVirtualCollectionId;
-    private String defaultVirtualCollectionName;
-    private String defaultVirtualCollectionDescription;
+    private String policyConfig;
 
     // deprec?!
     private final BACKENDS DEFAULT_ENGINE = BACKENDS.LUCENE;
@@ -159,10 +157,17 @@
         passcodeSaltField = properties.getProperty("security.passcode.salt",
                 "accountCreation");
         
-        defaultVirtualCollectionId = properties.getProperty("virtual.collection.default.id");
-        defaultVirtualCollectionName = properties.getProperty("virtual.collection.default.name");
-        defaultVirtualCollectionDescription = properties.getProperty("virtual.collection.default.description");
+        policyConfig = properties.getProperty("policies.config");
         
+        KUSTVAKT_USER.put(Attributes.ID, Integer.parseInt(properties.getProperty("kustvakt.init.user.id")));
+        KUSTVAKT_USER.put(Attributes.USERNAME, properties.getProperty("kustvakt.init.user.username"));
+        KUSTVAKT_USER.put(Attributes.PASSWORD, properties.getProperty("kustvakt.init.user.password"));
+        KUSTVAKT_USER.put(Attributes.EMAIL, properties.getProperty("kustvakt.init.user.email"));
+        KUSTVAKT_USER.put(Attributes.COUNTRY, properties.getProperty("kustvakt.init.user.country"));
+        KUSTVAKT_USER.put(Attributes.ADDRESS, properties.getProperty("kustvakt.init.user.address"));
+        KUSTVAKT_USER.put(Attributes.FIRSTNAME, properties.getProperty("kustvakt.init.user.firstname"));
+        KUSTVAKT_USER.put(Attributes.LASTNAME, properties.getProperty("kustvakt.init.user.lastname"));
+        KUSTVAKT_USER.put(Attributes.INSTITUTION, properties.getProperty("kustvakt.init.user.institution"));
 
         return properties;
     }
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/CollectionLoader.java b/src/main/java/de/ids_mannheim/korap/web/service/CollectionLoader.java
index 9dfe0a6..113df66 100644
--- a/src/main/java/de/ids_mannheim/korap/web/service/CollectionLoader.java
+++ b/src/main/java/de/ids_mannheim/korap/web/service/CollectionLoader.java
@@ -1,11 +1,23 @@
 package de.ids_mannheim.korap.web.service;
 
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.io.InputStreamReader;
+
 import de.ids_mannheim.korap.config.ContextHolder;
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
+import de.ids_mannheim.korap.resources.Corpus;
+import de.ids_mannheim.korap.resources.Foundry;
+import de.ids_mannheim.korap.resources.KustvaktResource;
+import de.ids_mannheim.korap.resources.Layer;
 import de.ids_mannheim.korap.resources.Permissions;
 import de.ids_mannheim.korap.resources.VirtualCollection;
+import de.ids_mannheim.korap.resources.Permissions.Permission;
 import de.ids_mannheim.korap.security.ac.PolicyBuilder;
 import de.ids_mannheim.korap.security.ac.ResourceFinder;
 import de.ids_mannheim.korap.security.ac.SecurityManager;
@@ -55,21 +67,73 @@
 //        c3.setFields(bui.toJSON());
 //        c3.setDescription("Goethe - Die Leiden des jungen Werther");
         
-        VirtualCollection c4 = new VirtualCollection();
-        c4.setName(config.getDefaultVirtualCollectionName());
-        c4.setDescription(config.getDefaultVirtualCollectionDescription());
+        PolicyBuilder builder = new PolicyBuilder(user);
+        String result = null;
+		BufferedReader br;
+		try {
+			File f = new File(config.getPolicyConfig());
+			br = new BufferedReader(new InputStreamReader(new FileInputStream(f)));
+		} catch (FileNotFoundException e) {
+			throw new KustvaktException("Policy config file: " + 
+					config.getPolicyConfig() + " does not exists!",
+					e.getCause(), 101);
+		}
+		String policy = null;
+		String[] policyData = null;
+		String type, id, name, description, condition;
+		String[] permissions;
+		try {
+			while ((policy = br.readLine()) != null) {
+				if (policy.startsWith("#") || policy.isEmpty()) continue;
+				policyData = policy.split("\t");
+				type = policyData[0];
+				id = policyData[1];
+				name = policyData[2];
+				description = policyData[3];
+				condition = policyData[4];
+				permissions = policyData[5].split(",");
 
-        PolicyBuilder b = new PolicyBuilder(user);
-        b.setPermissions(Permissions.Permission.READ);
-        b.setResources(c4);
-        b.setConditions("public");
-        String result = b.create();
+				Permission[] permissionArr = new Permission[permissions.length];
+				for (int i = 0; i < permissions.length; i++) {
+					if (permissions[i].equals("read")) {
+						permissionArr[i] = Permission.READ;
+					}
+				}
 
-        if (JsonUtils.readTree(result).size() > 0)
-            throw new KustvaktException(StatusCodes.REQUEST_INVALID,
-                    "creating collections caused errors", result);
+				KustvaktResource resource = createResource(type, id, name, description);
+				if (resource != null) {
+					builder = new PolicyBuilder(user);
+					builder.addCondition(condition);
+					builder.setResources(resource);
+					builder.setPermissions(permissionArr);
+					result = builder.create();
+					if (JsonUtils.readTree(result).size() > 0)
+			            throw new KustvaktException(StatusCodes.REQUEST_INVALID,
+			                    "creating collections caused errors", result);
+				}
+			}
+			br.close();
+		} catch (IOException e) {
+			throw new KustvaktException("Failed creating virtual collections.", e.getCause(), 100);
+		}
     }
 
+    private KustvaktResource createResource(String type, String id, String name, String description) {
+
+		KustvaktResource resource = null;
+		if (type.equals("virtualcollection")) {
+			resource = new VirtualCollection(id);
+			if (!name.isEmpty()) {
+				resource.setName(name);
+			}
+			if (!description.isEmpty()) {
+				resource.setDescription(description);
+			}
+		}
+
+		return resource;
+	}
+
 
     @Override
     public Class<? extends BootableBeanInterface>[] getDependencies () {
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/PolicyLoader.java b/src/main/java/de/ids_mannheim/korap/web/service/PolicyLoader.java
index 928b490..aba7506 100644
--- a/src/main/java/de/ids_mannheim/korap/web/service/PolicyLoader.java
+++ b/src/main/java/de/ids_mannheim/korap/web/service/PolicyLoader.java
@@ -1,12 +1,20 @@
 package de.ids_mannheim.korap.web.service;
 
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.io.InputStreamReader;
+
 import de.ids_mannheim.korap.config.ContextHolder;
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.resources.Corpus;
 import de.ids_mannheim.korap.resources.Foundry;
 import de.ids_mannheim.korap.resources.KustvaktResource;
-import de.ids_mannheim.korap.resources.Permissions;
+import de.ids_mannheim.korap.resources.Layer;
+import de.ids_mannheim.korap.resources.Permissions.Permission;
 import de.ids_mannheim.korap.security.ac.PolicyBuilder;
 import de.ids_mannheim.korap.security.ac.ResourceFinder;
 import de.ids_mannheim.korap.security.ac.SecurityManager;
@@ -18,40 +26,87 @@
  */
 public class PolicyLoader implements BootableBeanInterface {
 
-    @Override
-    public void load (ContextHolder beans) throws KustvaktException {
-        SecurityManager.overrideProviders(beans);
-        ResourceFinder.overrideProviders(beans);
+	@Override
+	public void load(ContextHolder beans) throws KustvaktException {
+		SecurityManager.overrideProviders(beans);
+		ResourceFinder.overrideProviders(beans);
 
-        User user = User.UserFactory
-                .toUser(KustvaktConfiguration.KUSTVAKT_USER);
-        KustvaktConfiguration config =beans.getConfiguration();
-        PolicyBuilder builder = new PolicyBuilder(user);
-        builder = new PolicyBuilder(user);
-        builder.addCondition("public");
-        builder.setResources(new Corpus(config.getDefaultVirtualCollectionId()));
-        builder.setPermissions(Permissions.Permission.READ);
-        builder.create();
+		User user = User.UserFactory.toUser(KustvaktConfiguration.KUSTVAKT_USER);
+		KustvaktConfiguration config = beans.getConfiguration();
+		PolicyBuilder builder = new PolicyBuilder(user);
+		BufferedReader br;
+		try {
+			File f = new File(config.getPolicyConfig());
+			br = new BufferedReader(new InputStreamReader(new FileInputStream(f)));
+		} catch (FileNotFoundException e) {
+			throw new KustvaktException("Policy config file: " + config.getPolicyConfig() + " does not exists!",
+					e.getCause(), 101);
+		}
+		String policy = null;
+		String[] policyData = null;
+		String type, id, name, description, condition;
+		String[] permissions;
+		try {
+			while ((policy = br.readLine()) != null) {
+				if (policy.startsWith("#") || policy.isEmpty()) continue;
+				
+				policyData = policy.split("\t");
+				type = policyData[0];
+				id = policyData[1];
+				name = policyData[2];
+				description = policyData[3];
+				condition = policyData[4];
+				permissions = policyData[5].split(",");
 
-        // FIX ME: the following policies are used in test cases and should not be hard coded here.
-        builder.addCondition("public");
-        builder.setResources(new Corpus("GOE"));
-        builder.setPermissions(Permissions.Permission.READ);
-        builder.create();
-        
-        KustvaktResource tt = new Foundry("tt");
-        tt.setName("TreeTagger");
-        tt.setDescription("todo ...");
-        builder = new PolicyBuilder(user);
-        builder.addCondition("public");
-        builder.setResources(tt);
-        builder.setPermissions(Permissions.Permission.READ);
-        builder.create();
-    }
+				Permission[] permissionArr = new Permission[permissions.length];
+				for (int i = 0; i < permissions.length; i++) {
+					if (permissions[i].equals("read")) {
+						permissionArr[i] = Permission.READ;
+					}
+				}
+				KustvaktResource resource = createResource(type, id, name, description);
+				if (resource != null) {
+					builder.addCondition(condition);
+					builder.setResources(resource);
+					builder.setPermissions(permissionArr);
+					builder.create();
+				}
+			}
+			br.close();
+		} catch (IOException e) {
+			throw new KustvaktException("Failed creating policies.", e.getCause(), 100);
+		}
+	}
 
+	private KustvaktResource createResource(String type, String id, String name, String description) {
 
-    @Override
-    public Class<? extends BootableBeanInterface>[] getDependencies () {
-        return new Class[] { UserLoader.class };
-    }
+		KustvaktResource resource = null;
+		if (type.equals("corpus")) {
+			resource = new Corpus(id);
+		} else if (type.equals("foundry")) {
+			resource = new Foundry(id);
+		} else if (type.equals("layer")) {
+			resource = new Layer(id);
+		}
+//			else if (type.equals("virtualcollection")) {
+//			resource = new VirtualCollection(id);
+//		}
+		else{
+			return resource;
+		}
+
+		if (!name.isEmpty()) {
+			resource.setName(name);
+		}
+		if (!description.isEmpty()) {
+			resource.setDescription(description);
+		}
+
+		return resource;
+	}
+
+	@Override
+	public Class<? extends BootableBeanInterface>[] getDependencies() {
+		return new Class[] { UserLoader.class };
+	}
 }
diff --git a/src/test/java/de/ids_mannheim/korap/security/ResourceFinderTest.java b/src/test/java/de/ids_mannheim/korap/security/ResourceFinderTest.java
index 5da39a4..6952945 100644
--- a/src/test/java/de/ids_mannheim/korap/security/ResourceFinderTest.java
+++ b/src/test/java/de/ids_mannheim/korap/security/ResourceFinderTest.java
@@ -24,7 +24,7 @@
         Set<VirtualCollection> resources = ResourceFinder
                 .searchPublic(VirtualCollection.class);
         assertFalse(resources.isEmpty());
-        assertEquals(3, resources.size());
+        assertEquals(1, resources.size());
     }
 
 
@@ -38,11 +38,11 @@
     @Test
     public void testResourcesDemoFiltered () throws KustvaktException {
         Set<Corpus> resources = ResourceFinder.searchPublicFiltered(
-                Corpus.class, "WPD");
+                Corpus.class, "WPD15");
         assertNotEquals(0, resources.size());
         assertEquals(1, resources.size());
 
-        resources = ResourceFinder.searchPublicFiltered(Corpus.class, "WPD",
+        resources = ResourceFinder.searchPublicFiltered(Corpus.class, "WPD15",
                 "GOE");
         assertNotEquals(0, resources.size());
         assertEquals(2, resources.size());
diff --git a/src/test/java/de/ids_mannheim/korap/security/ResourcesTest.java b/src/test/java/de/ids_mannheim/korap/security/ResourcesTest.java
index 99fd537..131d0bc 100644
--- a/src/test/java/de/ids_mannheim/korap/security/ResourcesTest.java
+++ b/src/test/java/de/ids_mannheim/korap/security/ResourcesTest.java
@@ -103,13 +103,13 @@
         Set s = ResourceFinder.searchPublic(Corpus.class);
         assertEquals(2, s.size());
         s = ResourceFinder.searchPublic(Foundry.class);
-        assertEquals(1, s.size());
+        assertEquals(7, s.size());
     }
 
 
     @Test
     public void getDemoResourceFiltered () throws KustvaktException {
-        Set s = ResourceFinder.searchPublicFiltered(Corpus.class, "WPD");
+        Set s = ResourceFinder.searchPublicFiltered(Corpus.class, "WPD15");
         assertEquals(1, s.size());
     }