---
source: cedar-policy-formatter/src/pprint/fmt.rs
expression: formatted
input_file: cedar-policy-cli/sample-data/tpe_rfc/policies.cedar
---
// Users can view public documents.
permit (
  principal,
  action == Action::"View",
  resource
)
when { resource.isPublic };

// Users can view owned documents if they are mfa-authenticated.
permit (
  principal,
  action == Action::"View",
  resource
)
when { context.hasMFA && resource.owner == principal };

// Users can delete owned documents if they are mfa-authenticated
// and on the company network.
permit (
  principal,
  action == Action::"Delete",
  resource
)
when
{
  context.hasMFA &&
  resource.owner == principal &&
  context.srcIP.isInRange(ip("1.1.1.0/24"))
};
