Hi, i'm currently working on some permissions on Cerbos Playground but tests results doesn't match with conditions i set for each role in my resource and i dont understand why. Thanks

Do you have the link to the playground?

yes you right. i forgot to save it. but i set some principals and resource on the right side and it says denied

Can you give me an example of a principal, resource and action that you used and got an unexpected result for?

principals :

{
  "id": "member123",
  "roles": [
    "MEMBER"
  ],
  "attr": {
    "user": {
      "employeeId": "test"
    }
  }
}

{
  "id": "owner123",
  "roles": [
    "OWNER"
  ],
  "attr": {}
}

and resource

{
  "id": "manage_content_id",
  "kind": "content",
  "attr": {
    "author": {
      "userId": "owner123",
      "employeeId": "test",
      "user": {
        "organisation": {
          "employees": [
            "member123"
          ],
          "owners": [
            "owner123"
          ],
          "managers": [
            "manager123"
          ]
        }
      }
    }
  }
}

I don't see any problem. I am guessing that the cause of your confusion is you're mixing up roles and derived roles. Derived roles are something that Cerbos decides based on the request data. All your derived roles are based on the

parentRole

of

user

. However, in your request, instead of saying that the principal's role is

user

, you're sending the name of the derived role.

oh yes i see. i did miss that part. Anyway it works now, thank you!