On p137 (version B6), under the section Cutting out repetitiveness with bypasses, it says
policy action(:force_update) do
authorize_if actor_attribute_equals(:role, "admin")
end
but it should be role: :admin
since the enum is using atom keys.