cedar-policy 4.10.0

Cedar is a language for defining permissions as policies, which describe who should have access to what.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

type Email = __cedar::String;
type PhoneNumber = __cedar::String;

namespace Organization {
    type DepartmentId = __cedar::String;

    entity Department = {
        "id": DepartmentId,
        "name": __cedar::String,
        "budget": __cedar::Long
    };

    entity Employee, Manager, Executive in [Employee] = {
        "email": Email,
        "phone"?: PhoneNumber,
        "department": Department
    };

    entity Status enum ["active", "inactive", "on_leave"];
}

namespace Documents {
    entity Document, Report, Memo in [Document] = {
        "title": __cedar::String,
        "author": Organization::Employee,
        "reviewers": Set<Organization::Manager>
    } tags {
        "classification": __cedar::String
    };

    action read, write, review appliesTo {
        principal: [Organization::Employee, Organization::Manager],
        resource: [Document, Report, Memo],
        context: {
            "timestamp": __cedar::Long,
            "ip_address": __cedar::String
        }
    };

    action approve in [review] appliesTo {
        principal: [Organization::Executive],
        resource: [Report],
        context: {}
    };
}