There seems to be a bug with the "ref change type" "has bit" rules in Herald.

When I tried to make a rule to stop dangerous changes, this was the result of a herald transcript:

{F140520}

Here is my herald rule:

{F140522}

As nearly as I can tell, this is what is happening:

case self::CONDITION_HAS_BIT:
  return (($condition_value & $field_value) === $condition_value);

When we get here, $condition_value is (string) "2" , $field_value is (int) 18.

($condition_value & $field_value) which is ("2" & 18) evaluates to (int) 2;

Finally, we compare that to $condition_value, so we get (int) 2 === (string) "2"

Which on my machine evaluates false.

Easy solution is to change that line to

return (($condition_value & $field_value) === (int)$condition_value);

FYI:

Ubuntu precise64 running:

PHP 5.3.10-1ubuntu3.10 with Suhosin-Patch (cli) (built: Feb 28 2014 23:14:25)
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies