:verify action on a resource, which I only want to run on resources which have :role set to :unverified The below works as expected (produces valid/invalid changesets as expected):one_of instead of attribute_equals seems to me like it should do the same thing, but it never seems to produce an invalid changeset: