So we have an application where users fundamentally belong to many organizations, and as such, they have different roles for each organization. Organizations can have child organizations as well, however is needed to organize and control their flow of data.

I want to use an ash policy to restrict the actions of users based on the role they have for the organization they are trying to perform the action on.

So I have the following table which associates a user to an organization and has their role for that organization on it

defmodule UsersOrganizations do

  use Ash.Resource,
    otp_app: :my_app,
    domain: User.Domain,
    data_layer: AshPostgres.DataLayer,
    authorizers: [Ash.Policy.Authorizer]

  attributes do
    uuid_primary_key(:id)

    attribute(:user_role, :atom,
      default: :default,
      allow_nil?: false,
      always_select?: true,
    )
  end

  relationships do
    belongs_to(:user, User, allow_nil?: false)

    belongs_to(:organization, Organization, allow_nil?: false)
  end
end

But I don’t know understand how to grab this relationship in a policy, such as this simplified situation below

defmodule MyResource do
    use Ash.Resource,
      otp_app: :my_app,
      domain: SomeResource.Domain,
      data_layer: AshPostgres.DataLayer,
      authorizers: [Ash.Policy.Authorizer]

    attributes do
     attribute :message_body, :string
    end

    relationships do
      belongs_to :sender, User
      belongs_to :organization, Organization
    end

    actions do 
      read :get_sender_information do
        #read sensitive user information, like a name and email.
     end
    end

    policies do
      policy action(:get_sender_information) do
        authorize_if #The reading user's role in the organization the message was sent in is :admin
      end
    end
 end

So my question is, what is the best approach to building out this sort of policy?

Loosely related question, is it possible to export Ash Policies as an Access Control List (ACL)?