When editing the roles on an auth policy, sporadic failure to remove those roles, when they are de-selected via the UI and the policy is re-saved.