kw role

Provide     = "provide" Type "=" Expr [ "for" "role" IdentList ] ;

ClusterClause = "seeds" Expr | "port" IntLit | "trace_sample" FloatLit | "auth" Block | "defaults" "{" { Ident Expr } "}"
            | "role" Ident "{" RoleClause { ( ";" | NL ) RoleClause } "}"
            | "assign" "by" Expr { "else" Expr } ;

pub(api) data User {
  pub(api) id: UserId
  pub(api) name: Name
  pub(api) email: Email?           @since(2)
  role: Role = Role.User
  createdAt: Time = now()
  invariant name != "admin" || role == Role.Admin
}

policy Orders {
  allow get(id)        if caller.isUser(db.find(Order, id)?.userId)
  allow list, recent   if caller.has(role: .Support)
  allow *              if caller.service("billing")
  deny  delete         unless caller.has(role: .Admin) && caller is .User(mfa: true, ..)
}

@public rpc health() -> Ok
@allow(role: .Admin) rpc purge() -> Ok
@internal rpc create(…) -> Order