# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: demo_action_wildcard
  schemas:
    principalSchema:
      ref: cerbos:///principal.json
    resourceSchema:
      ref: cerbos:///tenant_owned_resource.json
  importDerivedRoles:
    - demo_integration_roles
  rules:
  - name: sudo
    actions: ["*"]
    roles: [
      "sudo"
    ]
    effect: EFFECT_ALLOW
  - name: admin_can_make
    actions: ["make"]
    derivedRoles: [
      "mock_labelprofile_administrator"
    ]
    effect: EFFECT_ALLOW
  - name: admin_can_view_three_tiers
    actions: [
      "view:*",
      "view:*:*"
    ]
    derivedRoles: [
      "mock_labelprofile_administrator"
    ]
    effect: EFFECT_ALLOW
  - name: view_basic
    actions: ["view:basic"]
    derivedRoles: [
      "mock_labelprofile_accounting",
      "mock_insightsprofile_analytics"
    ]
    effect: EFFECT_ALLOW
  - name: view_accounting
    actions: [
      "view:accounting*",
      "view:accounting:advances:*"
    ]
    derivedRoles: [
      "mock_labelprofile_accounting"
    ]
    effect: EFFECT_ALLOW