Anyway, I just received an email from ForgeRock.
Web Policy Agents version 3.3.3
This email is being sent to you as our records show that you downloaded the latest maintenance release of the ForgeRock OpenAM Policy Agent 3.3.2.
An issue around policy enforcement was reported to ForgeRock and we took the decision to rescind the 3.3.2 release of the Policy Agents to be replaced with version 3.3.3.
If you have upgraded to version 3.3.2 we recommend moving to 3.3.3. If you have yet to install 3.3.2 then please use version 3.3.3 instead.
Remember I posted the release of Web Policy Agents version 3.3.2 just slightly more than a week ago? Internally, we tested WPA 3.3.2 on IIS 7 and Apache 2.4. The policies for SharePoint protected by policy agent on IIS 7 needed some tweaking before it worked. We rolled back the policy agent on Apache 2.4 to 3.3.1. So, there is indeed an issue around policy enforcement.
Web Policy Agents version 3.3.3 will definitely come in handy. We're going to give it a try tomorrow morning.