upstream-casbin/examples/rbac_with_abac_rule_policy.csv

1	# RBAC roles combined with a per-policy ABAC condition.
2	#
3	# p, role, object, action, cond, effect
4	#
5	# read attributes that every request reaching it actually supplies: reading an
6	# attribute the ctx does not have makes Enforce return an error rather than a
7	p, employee, data1, read, r.ctx.Hour >= 9 && r.ctx.Hour < 18, allow
8	p, employee, data2, write, r.ctx.Secure == true, allow
9	p, admin, data3, read, true, allow
10	# Deny overrides every allow above: a high-risk session gets nothing.
11	p, employee, *, *, r.ctx.Risk == 'high', deny
12	g, admin, employee
13	g, alice, admin
14	g, bob, employee