Resource Manager CreateJob returns 404 with target.job.operation + target.stack.id IAM conditions

I am using OCI Resource Manager in ap-hyderabad-1 with a dedicated non-admin API-signing user in the Default identity domain. The user belongs only to its automation group. Authentication works, and the same principal successfully performs ListInstances, ListJobs, and GetStack.

CreateJob returns 404 NotAuthorizedOrNotFound and creates no job.

Relevant policy (all resource and group identifiers are placeholders):

Allow group 'Default'/'<AUTOMATION_GROUP>' to use orm-stacks in tenancy
Allow group 'Default'/'<AUTOMATION_GROUP>' to read orm-jobs in tenancy
Allow group 'Default'/'<AUTOMATION_GROUP>' to manage orm-jobs in tenancy where all {target.job.operation = 'APPLY', target.stack.id = '<STACK_OCID>'}