derived_roles_1.yml

---
apiVersion: "api.cerbos.dev/v1"
derivedRoles:
  name: my_derived_roles
  definitions:
    - name: admin
      parentRoles: ["admin"]

    - name: tester
      parentRoles: ["dev", "qa"]

    - name: employee_that_owns_the_record
      parentRoles: ["employee"]
      condition:
        match:
          expr: request.resource.attr.owner == request.principal.id

    - name: any_employee
      parentRoles: ["employee"]

    - name: direct_manager
      parentRoles: ["manager"]
      condition:
        match:
          any:
            of:
              - expr: request.resource.attr.geography == request.principal.attr.geography
              - expr: request.resource.attr.geography in request.principal.attr.managed_geographies