diff --git a/keystore2/src/enforcements.rs b/keystore2/src/enforcements.rs
index 06648f1..2cc704b 100644
--- a/keystore2/src/enforcements.rs
+++ b/keystore2/src/enforcements.rs
@@ -804,7 +804,7 @@
                     let token_valid = now_in_millis
                         .checked_sub(auth_token_entry.time_received().milli_seconds())
                         .map_or(false, |token_age_in_millis| {
-                            token_age_in_millis > auth_token_max_age_millis
+                            auth_token_max_age_millis > token_age_in_millis
                         });
                     token_valid && auth_token_entry.satisfies(&sids, auth_type)
                 })