Role Per Region

Requirement: a contractor may read claims only for the region they are staffed to, and only while their contract is open. New regions are added roughly monthly and contracts start and end every week. Two candidate policies:

# policy A
package authz
import rego.v1

default allow := false

allow if {
  input.action == "read"
  "claims_reader_emea" in data.roles[input.subject.id]
  input.resource.region == "emea"
}

# policy B
package authz
import rego.v1

default allow := false

allow if {
  input.action == "read"
  input.subject.staffed_region == input.resource.region
  time.now_ns() < input.subject.contract_ends_ns
}

Which is the honest assessment?

B. RBAC cannot express a denial, and the requirement needs an explicit deny once the contract ends.

B. Policy A needs one rule and one role per region, and every contract start or end becomes a grant or revoke, so the policy and the role table both grow with the business. B is a single rule that reads facts the request already carries.

A. Roles are read from stored data, so the caller cannot influence the decision, whereas B trusts attributes that arrive on the request and can be forged.

A. Rego has no way to evaluate wall-clock time, so B would need an external data document refreshed before every decision, which reintroduces the staleness A avoids.