I am facing an strange issue. The backend is written in .Net Core and I add authorization policy to restrict user to visit. Since a user might have multiple roles, I design the policy
as follows in startup.cs