{
  "name": "envoy.filters.network.rbac",
  "typedConfig": {
    "@type": "type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC",
    "rules": {
      "action": "DENY",
      "policies": {
        "consul-intentions-layer4": {
          "permissions": [
            {
              "any": true
            }
          ],
          "principals": [
            {
              "authenticated": {
                "principalName": {
                  "safeRegex": {
                    "googleRe2": {},
                    "regex": "^spiffe://test.consul/ns/default/dc/[^/]+/svc/cron$"
                  }
                }
              }
            },
            {
              "authenticated": {
                "principalName": {
                  "safeRegex": {
                    "googleRe2": {},
                    "regex": "^spiffe://test.consul/ns/default/dc/[^/]+/svc/web$"
                  }
                }
              }
            },
            {
              "andIds": {
                "ids": [
                  {
                    "authenticated": {
                      "principalName": {
                        "safeRegex": {
                          "googleRe2": {},
                          "regex": "^spiffe://test.consul/ns/default/dc/[^/]+/svc/[^/]+$"
                        }
                      }
                    }
                  },
                  {
                    "notId": {
                      "authenticated": {
                        "principalName": {
                          "safeRegex": {
                            "googleRe2": {},
                            "regex": "^spiffe://test.consul/ns/default/dc/[^/]+/svc/web$"
                          }
                        }
                      }
                    }
                  },
                  {
                    "notId": {
                      "authenticated": {
                        "principalName": {
                          "safeRegex": {
                            "googleRe2": {},
                            "regex": "^spiffe://test.consul/ns/default/dc/[^/]+/svc/unsafe$"
                          }
                        }
                      }
                    }
                  },
                  {
                    "notId": {
                      "authenticated": {
                        "principalName": {
                          "safeRegex": {
                            "googleRe2": {},
                            "regex": "^spiffe://test.consul/ns/default/dc/[^/]+/svc/cron$"
                          }
                        }
                      }
                    }
                  }
                ]
              }
            }
          ]
        }
      }
    },
    "statPrefix": "connect_authz"
  }
}