TPM2_OA_USER_WITH_AUTH
TPM2_OA_USER_WITH_AUTH | \
flags |= options->policydigest_len ? 0 : TPM2_OA_USER_WITH_AUTH;