I was just looking at this yesterday in #1519 

We set `last_validated_at` **before** actually validating or loading the policy.  So both names are wrong: `last_validated_at` and `last_policy_reload`.