# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: apollo_mcp_pilot
  schemas:
    principalSchema:
      ref: cerbos:///principal.json
  importDerivedRoles:
    - ai_enablement
  rules:
  - name: use
    actions: ["use"]
    derivedRoles: [
      "any_tenant_ai_can_apollo_mcp_pilot"
    ]
    effect: EFFECT_ALLOW