Child policies must be subset of parent

Vault
1

i’ve got this bit of code

 resource “vault_token” “vault_token_nomad_server” {
 display_name = “nomad-server”
 policies     = [“default”, “nomad-server”]
 renewable    = true
 no_parent    = true
 ttl          = “72h”
 }

atlantis then tries to create a token
and i get

Error: error creating token: Error making API request.URL: POST https://vault/v1/auth/token/create
Code: 400. Errors:* child policies must be subset of parent

i suspect it is atlantis policy, but i dont know if it is, and if it is, what it should be