fix(policy): incorrect field-level permission check for nested create

fix(policy): incorrect field-level permission check for nested create #838