If checked and policies are defined in the Vault plugin configuration, a child token will be provisioned after authenticating with Vault with only the configured policies. See the Vault plugin configuration policies for more information.