redacted redacted redacted
this is because your policy does a pre-check if it should be applied when you use the target property. Since the #resource object is different for Document Read and Document List scope the check will work only for one of them.
See Data Services Authorization (and scroll a bit down) to have an understanding what the #resource object consists of. And either adapt your target checks by adding an || condition for it or what I recommend split your permissions by scope and then apply policies by scope.