Authorization bypass via incomplete bypass-policy expression

Incorrect authorization in Ash 3.6.3 through 3.7.0 allows remote authenticated users to access protected resources and actions. The Policy.expression/2 fold treats a true bypass condition, rather than the condition-and-check complete expression, as proof that a policy applies. Exploitation requires a matching bypass condition whose authorization checks fail while every other policy condition is false, granting unauthorized reads or actions without affecting availability.