---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
resource: foobar
version: "default"
rules:
- actions:
effect: EFFECT_ALLOW
roles:
- admin
- actions:
roles:
- employee
effect: EFFECT_ALLOW
- actions:
roles:
- employee
effect: EFFECT_ALLOW
- actions:
condition:
match:
expr: request.resource.attr.status == "PENDING_APPROVAL"
roles:
- manager
effect: EFFECT_ALLOW