Look through the policy and remove anything that has access to default_t that isn't required as part of system labeling.