It seemed like a thoughtful bug, but I didn't see anything about it in the documentation regarding the detailed example Policy1.
That's excellent flexible use of permissions.
cheers, Benjamin
