does a principal policy always override a resource policy?

Principal policy does take precedence over resource policy IF there is a principal policy matching the principal ID

for what it's worth, it looks like cerbos is matching principal ID and conditions in the principal policy to see if it has an explicit EFFECT_ALLOW or EFFECT_DENY. if it cannot find an explicit match, it will ignore the principal policy.

rules:
    - resource: "*"
      actions:
        - action: read
          condition:
            match:
              all:
                of:
                  - expr: R.kind == "123"
                  - expr: R.attr.data_org_id == "456"
          effect: EFFECT_ALLOW

so putting something like the above means if you submit a request with a resource.kind = "xxxx", it would not match the principal policy above. it would only match if your resource.kind = "123".

Yeah exactly, if no rule matches in the original policy then we fall through to the resource policy, so in your case you'll definitely need a rule with

EFFECT_DENY

and a condition like

R.kind != "123"

.