puppet_authz.rego

package puppet.authz

default allow = false

allow { not deny }

deny {
    resource = catalog.resources[resource_index]
    resource.type = "File"
    startswith(resource.title, "/etc/infra")
    resource_author[resource_index] = email
    not infra_team[email]
}

deny {
    resource = catalog.resources[resource_index]
    resource.type = "File"
    startswith(resource.title, "/etc/infra")
    resource_author[resource_index] = email
    not infra_team[email]
}