Hello, 👋 in a condition, can I evaluate a field in both

attr

? instead of using the ID of the principal? I don’t really get why I am getting denied 🤔 I wanna check the principal belongs to the same organization as the principal Resource:

apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: "default"
  resource: "audience_definition"
  importDerivedRoles:
    - common_roles
  rules:
    - actions: ["*"]
      effect: EFFECT_ALLOW
      derivedRoles:
        - Tenant

Edit: make sure the resource name in the YAML is the same in the playground resource 😅

Hello, 👋 Do you have a resource policy defined for the

audience

kind?

🤦