code: func NewWhereParser(ctx RuleContext) (predicate.Parser, error) {
  	return predicate.NewParser(predicate.Def{
  		Operators: predicate.Operators{
  			AND: predicate.And,
  			OR:  predicate.Or,
  			NOT: predicate.Not,
  		},
  		Functions: map[string]interface{}{
  			"equals":   predicate.Equals,
  			"contains": predicate.Contains,
  			// system.catype is a function that returns cert authority type,
  			// it returns empty values for unrecognized values to
  			// pass static rule checks.
  			"system.catype": func() (interface{}, error) {
  				resource, err := ctx.GetResource()
  				if err != nil {
  					if trace.IsNotFound(err) {
  						return "", nil
  					}
  					return nil, trace.Wrap(err)
  				}
  				ca, ok := resource.(CertAuthority)
  				if !ok {
  					return "", nil
  				}
  				return string(ca.GetType()), nil
  			},
  		},
  		GetIdentifier: ctx.GetIdentifier,
  		GetProperty:   GetStringMapValue,
  	})
  }
docs: // NewWhereParser returns standard parser for `where` section in access rules.