The "expr" module has been updated in the v3.0.x branch, which will become 3.0.5. The old version did not respect operator precedence. It just evaluated the string left to right. This forced people to use (...) to get the correct results. The new code implements precedence properly. As a bonus, it now supports bit shifts: 1 << 3 == 8 This is a minor feature which will make it easier to create simple policies. Alan DeKok.