// A destroy is approved by someone who could have done it alone: the approver holds
// the write grant for that tool. The real set should never allow a destroy this
// set denies.
@id("approver-can-write")
permit (principal, action == Action::"destroy", resource)
when {
  context has approved_by &&
  resource in context.approved_by.write_groups
};