# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
principalPolicy:
  principal: 4d5f24f5-83f9-4989-9f82-0924a5feaf88
  version: default
  rules:
    - resource: "infra"
      actions:
      - action: list_cache
        effect: EFFECT_ALLOW
      - action: bust_cache
        effect: EFFECT_ALLOW
      - action: bludgeon_cache
        effect: EFFECT_ALLOW
      - action: id_to_uuid_exchange
        effect: EFFECT_ALLOW
      - action: uuid_to_id_exchange
        effect: EFFECT_ALLOW
    - resource: identity
      actions:
      - action: attach_and_detach_role
        effect: EFFECT_ALLOW
        condition:
          match:
            expr: P.id == R.attr.identity_uuid
      - action: list_tenants
        effect: EFFECT_ALLOW
        condition:
          match:
            expr: P.id == R.attr.identity_uuid
      - action: view
        effect: EFFECT_ALLOW
        condition:
          match:
            expr: P.id == R.attr.identity_uuid
      - action: check_resources
        effect: EFFECT_ALLOW
        condition:
          match:
            expr: P.id == R.attr.identity_uuid
      - action: deactivate_all
        effect: EFFECT_ALLOW
        condition:
          match:
            expr: P.id == R.attr.identity_uuid
      - action: deactivate
        effect: EFFECT_ALLOW
        condition:
          match:
            expr: P.id == R.attr.identity_uuid