Any classes that expose the System.Security.Authentication.ExtendedProtection.ExtendedProtectionPolicy class should not allow the setting of null policies, should supply a default policy, or should require an explicit policy to be created and set by the application developer or administrator.