title: how [Authorize(Policy = "PolicyName")] works in asp.net core?
body: <p>can someone tell me how [Authorize(Policy = "PolicyName")] works, when the user is not logged in why policy runs? for example if i return 'true' from .RequireAssertion method's delegate, action or controller is accessible even user is anonymous user?</p>
  
  <pre><code>[Authorize]
  [Authorize(Policy = "TestAccess")]
  public async Task&lt;IActionResult&gt; Test()
  {
     return Json("Test Actioned Reached");
  }
  </code></pre>
  
  <p>why [Authorize] attribute is nacessary here? if [Authorize(Policy = "TestAccess")] means that - action/controller will be reached when user is not anonymous user AND this policy is passed?</p>
  
  <p>if i write:</p>
  
  <pre><code>[Authorize(Policy = "TestAccess")]
  public async Task&lt;IActionResult&gt; Test()
  {
      return Json("Test Actioned Reached");
  }
  </code></pre>
  
  <p>and policy look like that:</p>
  
  <pre><code>services.AddAuthorization(options =&gt; {
  options.AddPolicy("TestAccess", policy =&gt; policy.RequireAssertion(context =&gt;
     {
         return true;  // For Testing only
  
     }));
  });
  </code></pre>
  
  <p>Test() action will be reached even user is anonymous user. what this is happening? Sorry for my bad english. Thank you.</p>