Kira,

At the access policy layer, the default policy needs to specify what action to have in case there is no authentication.

For example, You may create an Identity policy to not authenticate certain traffic, such as Windows Update.

The global policy must be the final decision for all traffic (authenticated and not) and thus cannot be linked to an Identity policy (which may or may not require authentication).

Hope this helps.