diff --git a/swarm-nats-auth/src/policy.rs b/swarm-nats-auth/src/policy.rs
index 86a4d703..e4a69277 100644
--- a/swarm-nats-auth/src/policy.rs
+++ b/swarm-nats-auth/src/policy.rs
@@ -748,6 +748,13 @@ mod tests {
             format!("$JS.API.STREAM.PURGE.{STREAM}"),
             format!("$JS.API.STREAM.MSG.DELETE.{STREAM}"),
             format!("$JS.API.CONSUMER.CREATE.{STREAM}"),
+            // A named consumer, bare and with a key filter, which a grant of
+            // `CONSUMER.CREATE.<stream>.>` would cover.
+            format!("$JS.API.CONSUMER.CREATE.{STREAM}.c1"),
+            format!(
+                "$JS.API.CONSUMER.CREATE.{STREAM}.c1.{}",
+                key_subject("atlas")
+            ),
         ] {
             assert!(!may(&forbidden), "hive alpha may publish {forbidden}");
         }