User Access Authorization for Web Resources
If you're going to use const for some variables, then use that (or let) for all variables. Avoid var unless you have a good reason - e.g. you really need a global variable and/or hoisting.

The variable authResult can be eliminated from function isAdmin since it only gets a default value assigned, which then gets overwritten before it is returned. The function could merely return the value from the call to rolesBoundToAlias.some(). The arrow function passed to .some() could be declared on the previous line if you want, in an effort to decrease line length. Actually you might be able to just use Array.includes() bound to the array of roles instead of an extra arrow function. 

The name adminRolePolicy might be better named as DEFAULT_ROLES. I use all caps since it is more like a real constant that wouldn't change much - and could be declared outside the function if deemed appropriate. And while there is likely some overlap, Dev and BaseUser seem separate from the concept of admin.

Instead of calling the second parameter policyOverride, you could call it roles with the default of DEFAULT_ROLES - then there would be no need to assign the parameter to a different variable.