// The series 1 two-person rule as it was first published, without the write-grant
// guard: the approver is in the tenant and is not the requester, and nothing says the
// approver could have done the destroy alone. Composed into the set in place of the
// published forbid at prove time, so the counterexample the proof found stays on file.
@id("destructive-needs-approval-without-grant")
forbid (principal, action == Action::"destroy", resource)
unless {
  context has approved_by &&
  context.approved_by != context.user &&
  context.approved_by in context.tenant
};