# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: demo_impersonation
  schemas:
    principalSchema:
      ref: cerbos:///principal.json
  importDerivedRoles:
    - audience_development_multitenancy_roles
  variables:
    import:
      - common_variables
  rules:
  - name: allow_regardless_of_impersonation_because_yolo
    roles: ["user"]
    actions: ["yolo"]
    condition:
      match:
        any:
          of:
            - expr: V.principal_is_impersonated
            - expr: V.principal_is_not_impersonated
    effect: EFFECT_ALLOW
  - name: only_allow_machines_doing_work_on_behalf_of_someone_else
    roles: ["user"]
    actions: ["machine_obo_op"]
    condition:
      match:
        all:
          of:
            - expr: V.principal_is_impersonated
            - expr: V.principal_is_machine
    effect: EFFECT_ALLOW
  - name: do_not_allow_impersonation_on__sensitive_op
    roles: ["user"]
    actions: ["sensitive_op"]
    condition:
      match:
        expr: V.principal_is_not_impersonated
    effect: EFFECT_ALLOW
  - name: impersonation_flows_only
    roles: ["user"]
    actions: ["only_on_behalf_of"]
    condition:
      match:
        expr: V.principal_is_impersonated
    effect: EFFECT_ALLOW