Write the MFA and encryption policy

Objectives

Write Rego policy over the normalised input below. It must deny every user without MFA and every bucket without encryption at rest, including records where the field is missing, and it must refuse to pass when either collection is empty.

Every deny rule must produce a reason string with `msg :=`. The grader evaluates your rules against the fixture and against an empty input, using the semantics from Step 8.

{
  "users": [
    { "id": "alice", "status": "active", "mfa_enabled": true },
    { "id": "bob",   "status": "active", "mfa_enabled": false },
    { "id": "cara",  "status": "active" }
  ],
  "buckets": [
    { "id": "evidence", "encrypted": true },
    { "id": "exports",  "encrypted": false },
    { "id": "tmp" }
  ]
}

# also evaluated with: { "users": [], "buckets": [] }
# should be DENIED: bob, cara, exports, tmp, and both empty collections
# should be ALLOWED: alice, evidence

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Keep the rule shape

   Use `deny contains msg if { ... }` (or `deny[msg] { ... }`) with `some x in input.<collection>` to iterate. Write one condition per line.

   Policy parses into deny rules the grader can readEvery deny rule sets a reason with msg :=

2. Step 2

   Make absence fail

   Replace the equality test with the keyword that is true for both false and undefined. Check the result against bob and cara.

   Denies the user with MFA set to falseDenies the user with no MFA fieldAllows the enrolled user and the encrypted bucket

3. Step 3

   Add the second control

   Write a separate rule body for buckets. Two bodies with the same head are combined with OR.

   Denies unencrypted and missing-encryption buckets

4. Step 4

   Close the denominator

   Add one body per collection that denies when its count is zero. Without it, an empty export passes.

   Denies when users or buckets is empty

Rules summary

• XP on pass

  50 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 13 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.