The issue arises from the improper handling of ` in` and ` nin` operators in Directus, where empty arrays are evaluated as valid. This leads to Broken Access Control, as rules intended to pass only when a field matches any of the given values fail to function correctly. For instance, an expression like `{"role": {" in": $CURRENT USER.some field}}` would evaluate to true, allowing the request to pass even when it should not. This can result in users gaining access to unauthorized resources.