Simple policy

policy.rego

package policy

import future.keywords.if
import future.keywords.in

default allow := false

allow if {
# User attempting to access internal resource
# i.e. something under /internal
	input.request.path[0] == "internal"
    
	# So user must work for AcmeCorp
	endswith(input.user.email, "acmecorp.com")
    
	# And user must have the "acmecorp-internal" role
	"acmecorp-internal" in input.user.roles
}