def get_policies(key, service_account):
  """Returns Machine Provider policies governing the given instance.

  Args:
    key: ndb.Key for a models.Instance entity.
    service_account: Name of the service account the instance will use to
      talk to Machine Provider.
  """
  return {
      'backend_attributes': {
          'key': 'key',
          'value': key.urlsafe(),
      },
      'machine_service_account': service_account,
      'on_reclamation': 'DELETE',
  }