diff --git a/docs/plans/2026-08-04-authz-permissions-implementation.md b/docs/plans/2026-08-04-authz-permissions-implementation.md
index 95677ba5..41d40608 100644
--- a/docs/plans/2026-08-04-authz-permissions-implementation.md
+++ b/docs/plans/2026-08-04-authz-permissions-implementation.md
@@ -2967,10 +2967,14 @@ import type { AuthzCatalog } from "./types.ts";
 
 function union(values: string[]): string {
   if (!values.length) return "never";
+  // JSON.stringify, not hand-rolled escaping: role names reach this via the
+  // raw mergeCatalogs path without the registry's id validation, so a value
+  // may contain a newline, which manual quote/backslash escaping would emit
+  // as an unterminated string literal.
   return values
     .slice()
     .sort()
-    .map((value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`)
+    .map((value) => JSON.stringify(value))
     .join(" | ");
 }