# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: project_transfer
  schemas:
    principalSchema:
      ref: cerbos:///principal.json
    resourceSchema:
      ref: cerbos:///tenant_owned_resource.json
  importDerivedRoles:
    - abacus
  rules:
  - name: view_transfer_job
    actions: ["view"]
    derivedRoles: [
      "transfer_viewer",
      "transfer_creator",
      "transfer_operator",
      "any_tenant_transfer_viewer",
      "any_tenant_transfer_creator",
      "any_tenant_transfer_operator"
    ]
    effect: EFFECT_ALLOW
  - name: create_or_cancel_transfer_job
    actions: ["create"]
    derivedRoles: [
      "transfer_creator",
      "transfer_operator",
      "any_tenant_transfer_creator",
      "any_tenant_transfer_operator"
    ]
    effect: EFFECT_ALLOW
  - name: execute_transfer_batch
    actions: ["execute_batch"]
    derivedRoles: [
      "any_tenant_transfer_operator"
    ]
    effect: EFFECT_ALLOW