---
# System prepended metadata

title: Untitled

---

Assume a user has the following role assignments:
```python=
user.role_assignments = {
    "user": "quansight",
    "project manager": "open-teams",
}
```

with the following defined roles:
```python=
QADMIN_ROLES = {
    "administrator": True,
    "project_manager": {
        "http.GET": [
            RN_EMPLOYEE,
            RN_PROJECT_OVERVIEW,
            RN_EMPLOYEE_AVIL,
        ],
        EMPLOYEE_PM_ALL: True
    },
    "people_manager": {
        "http.GET": [
            RN_EMPLOYEE,
            RN_EMPLOYEE_UTIL,
            RN_EMPLOYEE_AVIL,
        ],
        EMPLOYEE_PM_ALL: True
    },
    "user": {
        "http.GET": [
            RN_EMPLOYEE,
        ],
        EMPLOYEE_PM_ALL: False
    }
}
```

To get the policy for the authenticated user:
```python=
def get_qadmin_policy_for(user):
    policy = RootPolicy()
    for role, context in user.role_assignments.items():
        policy.add_json_policy_for_context(context, QADMIN_ROLES[role])
    return role
```

Within some code, perhaps a panel, do something like this to authorize a request:
```python=
if get_qadmin_policy_for(user).should_allow(
        Permission("http.GET", "my-special-panel"), company-name):
    panel.show()
```

How do I restrict the "employee page" to only the page for the currently authenticated employee in the RN_EMPLOYEE?
```python=
{
    "user": {
        "http.GET": [
            {
                "resource_type": RN_EMPLOYEE,
                "condition": "$employee.id == $user.id",
            }
        ],
        EMPLOYEE_PM_ALL: False, # caching to indicate not allowed all, which is implied by the conditional expression
    }
}
```

Another way - with a clear condition type rather than CEL to make deriving queries and filters easier:
```python=
{
    "user": {
        "http.GET": {
             RN_EMPLOYEE: {
                "condition": {
                    "operator": "belongs-to-authenticated-user",
                },
            },
        },
    },
}
```