apiVersion: api.cerbos.dev/v1
resourcePolicy:
 version: default
  resource: abacExample
  rules:
    # If the principal's role is ADMIN then all the actions are allowed.
    - actions:
        - "*"
      effect: EFFECT_ALLOW
      roles:
        - ADMIN
    # If the principal's role is USER or MANAGER then creating is allowed.
    - actions:
        - create
      effect: EFFECT_ALLOW
      roles:
        - USER
        - MANAGER

    # If the principal's role is USER they read a resource as
    # long as it is published or owned by the user
    - actions:
        - read
      effect: EFFECT_ALLOW
      roles:
        - USER
      condition:
        match:
          any:
            of:
              - expr: request.resource.attr.isPublished == true
              - expr: request.resource.attr.ownerId == request.principal.id


    # If the principal's role is MANAGER then they can also update
    - actions:
        - update
      effect: EFFECT_ALLOW
      roles:
        - MANAGER