I’m getting an unexpected policy access failure.

Here’s the policy:

policies
  policy action :read do
    authorize_if expr(is_public == true or ^actor(:active) == true)
  end
end

When I read the resource like this:

{:ok, _event} = Ash.get(GF.Events.Event2, event.id)

It fails with this policy breakdown:

15:13:00.150 [warning] GF.Events.Event2.read

Policy Breakdown
unknown actor

  Policy | 🔎:

    condition: action == :read

    authorize if: (is_public == true) or (nil == true) | ✘ | 🔎

SAT Solver statement: 

 "action == :read" and
  (("action == :read" and "(is_public == true) or ({:_actor, :active} == true)") or
     not "action == :read")

But when I remove the part of the policy expression after the or, it passes:

authorize_if expr(is_public == true)

I would expect that if expr(is_public == true) passes, then, expr(is_public == true or any_valid_expression) should also pass.

I also tried these variations:

1. Passing an actor that has the attribute active: true. This passes, as expected.
2. Passing an actor that has the attribute active: false. This passes, as expected.

It seems that the ^actor(:active) is being evaluated, affecting the boolean expression, even though the first part of the expression should have short-circuited the second.

I saw the “unknown actor” in the policy breakdown, but I’m not sure what to do about it.

How do I solve this?