# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
principalPolicy:
  principal: 2aa8d761-732f-4853-afd3-2e6dcfac47cc
  version: default
  constants:
    import:
      - account_tenant_uuids
  rules:
    - resource: identity
      actions:
      - action: attach_and_detach_role
        effect: EFFECT_ALLOW
        condition:
          match:
            all:
              of:
                - expr: R.attr.tenant.tenant_type == 'account'
                - expr: R.attr.tenant.tenant_uuid == C.frenchkiss_tenant_uuid
                - expr: P.id == R.attr.identity_uuid