explicitly state that this policy is limited to TPA in scope

This also introduces a link to the core membership policy which we
refer to elsewhere in the document.