What is a common mistake when working with policy-based authorization?

A common mistake with policy-based authorization is creating one policy for every tiny code path without a clear authorization model can make permissions harder to understand than the original inline checks. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.