* Based on the documentation, when working with ABAC policies in Permit.io, role attributes need to be referenced differently than regular user or tenant attributes. In ABAC conditions, you reference role assignments using

user.roles

with the

array_contains

operator (1) (2) . Here's how it works: For checking if a user has a specific role in your ABAC conditions:

{
  "user.roles": {
    "array_contains": "AccountOwner"
  }
}

(2) (3) This is different from regular user attributes (like

user.university

or

user.is_full_time

) which are referenced directly (1) . Role information is stored as an array of role keys assigned to the user, not as a standard attribute (1) (2) . If you're trying to create conditions based on roles, you'll need to combine them with other user or resource attributes. For example:

{
  "allOf": [
    {
      "user.roles": {
        "array_contains": "admin"
      }
    },
    {
      "user.time_based_groups": {
        "any_match": {
          "match": {
            "expires": {
              "greater-than-equals": {
                "ref": "user.current_time"
              }
            }
          }
        }
      }
    }
  ]
}

(2) To help debug your specific issue, could you share: 1. Which Workspace / Project / Env you are using 2. What calls you are performing (as SDK code or CURL) 3. Which PDP version you are running 4. The relevant logs from your PDP showing the attribute complaint This will help our engineers investigate the specific error you're encountering.

To learn more, see the sources I considered: [[1] Building Your First ABAC Policy](https://docs.permit.io/how-to/build-policies/abac/building-abac-policy) [[2] Time Based Role Example](https://docs.permit.io/how-to/build-policies/abac/time-based-role) [[3] Fintech / Banking Demo Application](https://docs.permit.io/modeling/mesa-verde)

Appreciate the feedback! Feel free to ask me again with additional guidance or context.

You can still use the role itself as an attribute as part of the policy, and of course the user or tenant attributes

But I can choose attributes defined on roles in the ABAC policy editor (when creating a resource set). How does this then work? 🤔

Anyways as this feature isn’t very mature, I’m not sure I’d recommend using it