- id: fixture:demo-app-access-allow
  request:
    subject:
      id: user:alice
      attributes:
        groups: [app-users]
        assurance: {level: aal2, mfa: true}
    action: application.access
    resource: {id: demo-app, type: application, system: demo-app}
  expect:
    effect: allow
    reason: app_user
- id: fixture:demo-app-access-deny-no-mfa
  request:
    subject:
      id: user:bob
      attributes:
        groups: [app-users]
        assurance: {level: aal1, mfa: false}
    action: application.access
    resource: {id: demo-app, type: application, system: demo-app}
  expect:
    effect: deny
    reason: no_matching_rule