There were these typos in the class (one s too much and a space):

and I was wondering why the policy does not do it's job. In the provisiond debug log was no hint to find this issue.
The UI does not allow such faults but when the configs are created directly in the config files it can happen.