Ash Policies around :change_password action

update :change_password do
  # Use this action to allow users to change their password by providing
  # their current password and a new password.

  require_atomic? false
  accept []
  argument :current_password, :string, sensitive?: true, allow_nil?: false

  argument :password, :string,
    sensitive?: true,
    allow_nil?: false,
    constraints: [min_length: 8]

  argument :password_confirmation, :string, sensitive?: true, allow_nil?: false

  validate confirm(:password, :password_confirmation)

  validate {AshAuthentication.Strategy.Password.PasswordValidation,
            strategy_name: :password, password_argument: :current_password}

  change {AshAuthentication.Strategy.Password.HashPasswordChange, strategy_name: :password}

  # validates that the password meets our password policy
  if Application.compile_env(:paddy, :enforce_password_policy) do
    validate MyApp.Validations.PasswordAllowed, before_action?: true
  end
end

** (Ash.Error.Unknown) 
Bread Crumbs:
  > action validation {AshAuthentication.Strategy.Password.PasswordValidation, [strategy_name: :password, password_argument: :current_password]}
  > building changeset for MyApp.Accounts.User.change_password