Ensure Auth rules are ANDed together, not ORed