package play import rego.v1 default allow := false allow if { user := input.id user in data.groups.A user in data.groups.B not user in data.groups.C }