apiVersion: v1
data:
  forbid-write.rego: |+
    package dataapi.authz

    rule[{"policy": description}] {
    description := "Forbid writing sensitive data to theshire and neverland object-stores in datasets tagged with `finance`"
      input.action.actionType == "write"
      input.resource.metadata.tags.finance
      input.action.destination != "theshire"
      input.action.destination != "neverland"
      input.resource.metadata.columns[i].tags.sensitive
    }

kind: ConfigMap
metadata:
  labels:
    openpolicyagent.org/policy: rego
  name: forbid-write
  namespace: fybrik-system

