hi 👋. when using the Prisma integration, how are conditions based on the principal evaluated? are they done in Cerbos, then the resource-based conditions are returned as part of the query plan?

Yes. Here is a quick example of a policy expression having both resource and principal attributes.

request.resource.attr.department == request.principal.attr.department

The principal attributes are known at the time of the call. Let’s say the principal department is

marketing

, so the query plan will contain an AST of

request.resource.attr.department == "marketing"

.

what about expressions where the resource is not involved? e.g.

request.principal.attr.department == "marketing"

?

Then the expression will be evaluated to

true,

so the query planner will return

KIND_ALWAYS_ALLOWED

ok awesome thanks dennis!

No worries. If you want to go into detail, I wrote a blog post.

yes!! thank you