Identity was granted with permissions that denied in policy

[rks889]

Bug description

MinIO KES (k8s deployment, minio/kes:2025-01-30T09-41-53Z) has the following policy within the config:

    policy:
      minio-dev-policy:
        allow:
          - /v1/key/create/*
          - /v1/key/generate/*
          - /v1/key/decrypt/*
          - /v1/key/bulk/decrypt
          - /v1/key/list/*
          - /v1/status
          - /v1/metrics
          - /v1/log/audit
          - /v1/log/error
        deny:
          - /v1/key/*/bucket1-key
          - /v1/key/*/bucket2-key
        identities:
          - 2dd0966a0fbb428f9742654f049c99019cb5f77bbbdfefba6c52d00405a12d90

Creating key:
kes key create bucket2-key -k
Getting in logs:
time=2025-02-26T16:32:45.217Z level=INFO msg="secret key 'bucket2-key' created" req.method=POST req.path=/v1/key/create/bucket2-key req.ip=127.0.0.1 req.identity=2dd0966a0fbb428f9742654f049c99019cb5f77bbbdfefba6c52d00405a12d90 res.code=200 res.time=1.137481ms

Expected behavior

Error: failed to create key "bucket2-key": not authorized: insufficient permissions