Polar 2

Polar_vehicle_authz_users.polar

actor User {}

resource Vehicle {
  permissions = ["security", "update", "updateAuthorizedUsers"];
  roles = ["admin", "manager", "booked-user"];

  "security" if "booked-user";
  "update" if "manager";
  "updateAuthorizedUsers" if "admin";

  "manager" if "admin";
  "booked-user" if "manager";
}

has_role(actor: User, "admin", _vehicle: Vehicle) if
  role in actor.roles and
  "admin" = role.name;

has_role(actor: User, role_name: String, vehicle: Vehicle) if
  role in actor.roles and
  role_name = role.name and
  vehicle = role.resource;

allow(actor, action, resource) if
  has_permission(actor, action, resource);