Is the 403 returned upon policy creation then?  There doesn't seem to be an assert for the 403 status code.