Application Policy-driven authorization

[chupacabra71]

Describe the bug
The documentation says that when multiple policies are attached to an Application, you have the option of configuring it to pass if ALL or ANY return True. I see where to set this in a stage, but it is not there for application bindings. If you add multiple policies, currently ANY of them returning True Passes the test. The solution i found was to combine my policies into a single Expression Policy and using that in the binding, but this could potentially have a side effect of having a ton of policies defined, making things overly complicated.

To Reproduce
Steps to reproduce the behavior:

1. create application
2. add more than one policy binding (e.g. Group Binding and local IP binding)
3. application will still be visible if either is true

Expected behavior
Expected the application not to show unless both conditions were met.

Version and Deployment (please complete the following information):

• authentik version: [e.g. 2024.12.3]
• Deployment: docker-compose