Cerbos is the open core, language-agnostic, scalable authorization solution that makes user permissions and authorization simple to implement and manage.

Cerbos Community

Is there a way to pass in a resource, action, effect and determine all of the principles or roles that would match?

~Not out of the box. I think it is possible with a client app making a few calls to Admin API and PlanResources API.~
~Often the effect depends on the principal attributes, hence the need for PlanResource API.~

No, there isn’t (at least yet). This would require an equivalent of PlanResource API but for principals.