// request-scope without the if/then/else: one forbid per scope. Proved
// equivalent to the original under the series 1 schema.
@id("request-scope-read")
forbid (principal, action == Action::"read", resource)
unless { resource in context.delegated_read_groups };

@id("request-scope-write")
forbid (principal, action in [Action::"write", Action::"destroy"], resource)
unless { resource in context.delegated_write_groups };