One of the create policy examples is incorrect and some of our existing docs indicated you could use READ as a permission in GRANT, which should actually be SELECT.