# rbac for sysadmin
condition: tenant=="system" && roles.contains("admin")
is_admin: true
policy:
  *: allow