This check is true when the current action is private (public?: false).

Use it to bypass authorization for internal-only actions that must never be exposed by API extensions (e.g. AshGraphql, AshJsonApi):

policy bypass private_action?() do
  authorize_if always()
end