Local policy error when disabling SIP on Big Sur/M1

I'm trying to disable System Integrity Protection on an M1 Mac. csrutil disable as well as csrutil authenticated-root disable fail with an error: > csrutil: Failed to update security configuration for "Macintosh HD": Failed to create local policy How can I avoid this failure? What is causing it? ---- This a brand-new Big Sur 11.0 (20A2411) on M1 MBP. FileVault is off. I'm booting into the new "Options" mode, and launching Terminal from there. Authentication is certainly OK, as I get a different error if I enter a wrong password. The user partition is accessible in this mode, I can write to /Volumes/Macintosh HD/Users/me/ for example.

-bash-3.2# csrutil disable
Turning off System Integrity Protection requires modifying system security.
Allow booting unsigned operating systems and any kernel extensions for OS "Macintosh HD"? [y/n]: y

Enter password for user admin: 
Mounted /dev/disk3s3 at 
Unmounted /dev/disk3s3 (  )
csrutil: Failed to update security configuration for "Macintosh HD": Failed to create local policy