A customer-managed policy is a reusable document that identities or groups can reference. Creating that policy doesn't attach it, and attaching a policy to a group doesn't add a user to the group. Verify the complete permission path rather than assuming a resource with the right name has already taken effect.
A role trust policy is a different document. It controls the modeled role-assumption request, including its principal and supported conditions. An external ID can be one condition in a partner-access arrangement; it doesn't replace the trusted principal or the resulting role permissions. The local trust tool evaluates the trust side only. Real cross-account assumption also needs the caller's applicable permission, so a successful trust test alone isn't a claim that the complete external account workflow has been authorized.