PolicyFlow

// A policy governing actions within the 'documents' namespace.
policy DocumentAccess {
    actions: ["documents:**"] // This policy will only run for document-related actions.

    rules {
        rule AllowAdminsToRead {
            // Check if the action is specifically 'documents:read:confidential'
            when action == "documents:read:confidential" AND "admin" in user.roles
            then ALLOW
        }

        rule AllowEditorsToWrite {
            // Check if the action is any kind of 'write' action within the documents namespace.
            when action.Matches("documents:write:*") AND "editor" in user.roles
            then ALLOW
        }
    }
}