Cannot create policy for host on host

My machine testclient is connected to a repo and I can create snapshots without problems.

However, when I try to create a host policy on that host, I get an error message:

root@testclient# kopia policy set @testclient --add-ignore .cache
Setting policy for ’@testclient’
 - adding ".cache" to "ignore rules"
ERROR can't save policy for ’@testclient’: error writing policy manifest: access denied

When I run the same command on the kopia repo server, it works.

Shouldn’t I be able to create, edit, and delete a host policy for the host testclient on the host testclient?

The default ACL allows to edit policies for username@hostname and username@hostname:/path and read host-level policies for their own hostname.