app CRM @0.1 {
  auth jwt
}

policy Lead {
  create authenticated
  read owner_or_manager(Lead.seller)
  update owner_or_manager(Lead.seller)
  delete role(admin)
}

entity User {
  role: enum(admin, manager, seller) default(seller)
}

(* Propostos — fora da gramática v0.1 *)
permission export_reports

policy Report {
  read permission(export_reports)
}

api {
  rate_limit 100/minute
  cors {
    allow "https://app.example.com"
  }
}

endpoint Login {
  rate_limit 5/minute
}