* You're correct that the UI currently requires creating separate user sets and resource sets for each condition combination. However, you ​*can*​ achieve a "generic" dynamic matching policy using a ​*Resource Set*​ with a condition that compares the resource attribute to the user attribute using a reference (

ref

) . Here's how this works conceptually: ​*Create a Resource Set with a dynamic condition*​ that checks if the resource's region matches the user's region. The condition would use a reference to compare attributes:

{
  "allOf": [
    {
      "resource.region": {
        "equals": {
          "ref": "user.region"
        }
      }
    }
  ]
}

(1) This pattern is demonstrated in the Mesa Verde banking demo, where a User Set compares

user.location

to

user.country

using the

ref

keyword:

resource "permitio_user_set" "Safe_Owners" {
  key = "Safe_Owners"
  name = "Safe Owners"
  conditions = jsonencode({
    "allOf" : [
      {
        "user.location" : {
          "equals" : {
            "ref" : "user.country"
          }
        }
      }
    ]
  })
}

​*The limitation*​: The current UI may not expose the ability to create this type of cross-attribute reference condition directly. You would likely need to configure this via: • The ​*Terraform provider*​ (as shown above) • The ​*Permit API*​ directly For your specific case, you'd create a Resource Set where

resource.region

equals

{ "ref": "user.region" }

, then assign permissions to that resource set. Check out these potentially useful sources for more details: • ABAC Design Patterns • Create an ABAC Policy • Fintech / Banking Demo Application Would you like me to provide a general answer on how to set this up via the API, or would you prefer to reach out to our team at help@permit.io for guidance on UI capabilities?

To learn more, see the sources I considered: [[1] Fintech / Banking Demo Application](https://docs.permit.io/modeling/mesa-verde)

Thanks for the feedback, glad I was helpful.

You need to combine it with a "role" (either RBAC or ABAC UserSet) so that you can assign permissions:

Then you can need to sync the users, and bob's your uncle: /allowed

curl --location '<http://localhost:7766/allowed>' \
--header 'x-permit-sdk-language: <string>' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer permit_key_' \
--data '{
    "user": {
        "key": "bob",
        "attributes": {
            "location": "US"
        }
    },
    "action": "create",
    "resource": {
        "type": "application",
        "attributes": {
            "location": "US"
        }
    }
}'

Response:

{
  "allow": true,
  "debug": {
    "abac": {
      "allow": true,
      "allowing_rules": [
        {
          "resourceset": "resourceset_In_5fCountry_5fApp",
          "userset": "userset_UserSetForPermissions"
        }
      ],
      "code": "allow",
      "reason": "user 'bob' matched 'userset_UserSetForPermissions' userset conditions, the given resource matched the 'resourceset_In_5fCountry_5fApp' resourceset conditions, users matching 'userset_UserSetForPermissions' userset conditions has the 'create' permission on resources of type 'application' matching 'resourceset_In_5fCountry_5fApp' resourceset conditions"
    },
    "request": {
      "action": "create",
      "resource": {
        "attributes": {
          "location": "US",
          "type": "application"
        },
        "type": "application"
      },
      "tenant": null,
      "user": {
        "attributes": {
          "key": "bob",
          "location": "US",
          "roles": [],
          "tenants": []
        },
        "key": "bob",
        "synced": true
      }
    }
  },
  "result": false
}

@Tsai Dylan ☝️