It seems that Herald Edit Logs bypass policy checks. Specifically, if I go to /herald/history/ then I am able to see the edit history for Herald rules which I otherwise don't have access to see.
For example, at https://secure.phabricator.com/herald/history/ I can see "Rule 104: Created rule 'Watch Support Issues'`, but going to https://secure.phabricator.com/herald/rule/104/ returns "You Shall Not Pass: Restricted Herald Rule".