From the link above:
A list of policies for the token. This must be a subset of the policies belonging to the token making the request, unless the calling token is root or contains
sudocapabilities toauth/token/create.
Does the token being used to create the restricted token have the same policy linked to it? I don’t mean the same capabilities because obviously it has more capabilites, I mean the actual policy.