Cedar Integration

POLICY_BACKEND=cedar
CEDAR_URL=http://cedar:8180
CEDAR_FALLBACK_TO_BUILTIN=true

// Allow any agent to authorize read-only grants
permit(
  principal is Grantex::Agent,
  action == Grantex::Action::"authorize",
  resource is Grantex::Grant
) when {
  context.scopes == ["read"]
};

// Deny delegation beyond depth 2
forbid(
  principal is Grantex::Agent,
  action == Grantex::Action::"authorize",
  resource is Grantex::Grant
) when {
  context.delegationDepth > 2
};