When the access_policy permissions fail, they don't provide a ton of info about why.

For the most part, it's just a permission_denied error exposed to the user.

And no explanatory info is logged server side.

Since the access_policy permissions are a somewhat complex set of rules and conditions already and likely to get more complex, it would be useful to have more info about the permissions checks presented. 

For server side, this likely means additional (debug) logging.

For client/user, the errors returned could possibly provide some more context.

For example, which AccessPolicy failed, which set of statements / deployment mode, etc.