21 lines
821 B
CSV
21 lines
821 B
CSV
# RBAC roles combined with a per-policy ABAC condition.
|
|
#
|
|
# p, role, object, action, cond, effect
|
|
#
|
|
# "cond" is a matcher expression evaluated against the ctx argument of the
|
|
# request. Write "true" for a policy that carries no condition. A cond may only
|
|
# read attributes that every request reaching it actually supplies: reading an
|
|
# attribute the ctx does not have makes Enforce return an error rather than a
|
|
# plain "denied", so pass a struct (or a map with every attribute filled in).
|
|
|
|
p, employee, data1, read, r.ctx.Hour >= 9 && r.ctx.Hour < 18, allow
|
|
p, employee, data2, write, r.ctx.Secure == true, allow
|
|
p, admin, data3, read, true, allow
|
|
|
|
# Deny overrides every allow above: a high-risk session gets nothing.
|
|
p, employee, *, *, r.ctx.Risk == 'high', deny
|
|
|
|
g, admin, employee
|
|
g, alice, admin
|
|
g, bob, employee
|