rage.fail

control-via-admin

Admin over a resource = control of it.

derived any cloud emits Controls

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'attacker': None} CanAdminister {'resource': None}

emit

source type	`Identity`
target type	`*`
source	`?attacker`
target	`?resource`
state logic	ACTIVE

Raw rule rules/derived/can-control.yaml

id: control-via-admin
emits: Controls
description: Admin over a resource = control of it.
applies_to:
- '*'
match:
- - attacker: null
  - CanAdminister
  - resource: null
emit:
  source_type: Identity
  target_type: '*'
  source: ?attacker
  target: ?resource
  state_logic: ACTIVE
  derived_from:
  - ?attacker CanAdminister ?resource