If it's a PipePolicy, it should work to block it. Grep your logs with "ditto.system.policy" to make sure it's even using the policy.