Control spec patch for exit-policy/reject-private/*

The changes in #17183 (moved) need a control-spec patch