# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: "default"
  resource: subaccount
  schemas:
    principalSchema: 
      ref: cerbos:///principal.json
    resourceSchema: 
      ref: cerbos:///subaccount.json
      ignoreWhen: 
        actions: ["create"]
  importDerivedRoles:
    - multitenancy_roles
  rules:
  - name: you_can_view_your_tenant_subaccount
    actions: ["view"]
    derivedRoles: ["subaccount_tenant"]
    effect: EFFECT_ALLOW