AZ303: Inheritance with no starting point

can view = parent.view only passes on what a folder above has, and nothing gives it to the one at the top. Say what grants it directly.

Reported when the policy is compiled: rowfence check, the editor, rowfence dev.

The mistake

app role app_user
type user = app.users
type folder = app.folders
  owner  : user = owner_id
  parent : folder = parent_id
  can edit = owner
  can view = parent.view

line 7: folder.view needs a starting point besides inheritance [AZ303]

Fixed

app role app_user
type user = app.users
type folder = app.folders
  owner  : user = owner_id
  parent : folder = parent_id
  can edit = owner
  can view = edit or parent.view