# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
principalPolicy:
  principal: 8381d841-beba-42b6-a3a6-8133b1ab2aa8
  version: default
  rules:
    - resource: identity
      actions:
      - action: list_tenants
        effect: EFFECT_ALLOW
        condition:
          match:
            any:
              of:
              - expr: P.id == R.attr.identity_uuid
              - expr: R.id.startsWith("a3dec29d-b09b-4153-91bc-76a8bbb94c45") # ows-users seat admin user
              - expr: R.id.startsWith("db12599a-5e54-4feb-a9cb-7496e5b78521") # ows-users integration test user
      - action: view
        effect: EFFECT_ALLOW
        condition:
          match:
            any:
              of:
              - expr: P.id == R.attr.identity_uuid
              - expr: R.id.startsWith("a3dec29d-b09b-4153-91bc-76a8bbb94c45") # ows-users seat admin user
              - expr: R.id.startsWith("db12599a-5e54-4feb-a9cb-7496e5b78521") # ows-users integration test user
      - action: validate_invitation
        effect: EFFECT_ALLOW