API Policies - Custom Policy

entities:
  User:
    authenticable: true
    properties: 
      - name
      - {name: role, type: choice, options: {values: ["admin", "mod", "user"], default: "user"}}

entities:
  Invoice 🧾:
    properties:
      - number
      - { name: issueDate, type: date }
    policies:
      create:
        - { access: custom, allow: UserRole ["admin", "mod"] }
      update:
        - access: admin
      delete:
        - access: forbidden


policies: 
  UserRole:
    User:
      - {property: role, policy: restricted}