---
id: testdata.other-app
name: readback test package other-app
namespace: testdata:other-app
version: v1
status: fixture
package: flexauth.testdata.other_app
actions:
  - read
owner: team:platform-security
fixtures:
  - policy_fixtures.yaml
caring:
  profile: caring-0.4.0-rc2
  enforce: false
  canonical_roles: [Operator]
  organization_relations: [ServiceProvider]
  scopes:
    - {level: Platform, id: platform:testdata, tenant: tenant:platform}
  planes: [Identity]
  capabilities: [Use]
  exposure_modes: [Metadata]
  conditions: [Logged]
  restrictions: [PrivilegeEscalationBlocked]
---

# Readback test package (FLEX-WP-0035)

Test-only. Do not copy.

```rego
import future.keywords.if
import future.keywords.in

default decision := {"effect": "deny", "reason": "no_matching_rule"}

decision := {"effect": "allow", "reason": "app_user"} if {
  input.action == "application.access"
  "app-users" in input.subject.attributes.groups
  input.subject.attributes.assurance.mfa == true
}
```

```rego test
package flexauth.testdata.other_app_test
import future.keywords.if
import data.flexauth.testdata.other_app

test_default_deny if {
  other_app.decision.effect == "deny" with input as {"action": "read", "subject": {"attributes": {}}}
}
```