OAuth Custom Attribute for new and **existing** users

We are running Authentik in our k8s cluster, and I'd like to have a way to have users agree to the cluster policy just **once before** before being redirected to the OAuth provider. By just once, I mean so it doesn't keep popping up for them every time with every Application.

The way I tried doing it was by adding a checkbox Stage as part of the Authentication Flow, with an expression policy, and my understanding is that the **if the user custom attribute exists**, I can set it as True from the expression policy, and have a stage to skip this prompt stage. This way users don't have to see it again.

The issue with that is that already existing users don't have the custom attribute, and an OAuth property mapping wouldn't be retroactive.

Is there a different way to do this?

the TL;DR: How can I add a stage that prompt users' agreeing to policy (checkbox/agree button....) so that new and existing users only have to see it and agree once?

Authentik version: 2025.2.1
Kubernetes version: v1.28