There should be a default policy for everyone to view profile already, so you need to disable that policy first. Policies are additive, so if you have a broad policy, adding additional fine grained ones have no additional effect. You should take note of that when trying to implement policies