Write a Cedar policy with condition blocks to grant access only during business hours and from a specific IP range

Steps

1. Define entities: principal type User, resource type Document, action types [Read, Write] in the Cedar schema file
2. Write a permit policy with a when condition: 'permit(principal, action == Action::"Read", resource in ResourceGroup::"public") when { context.time.hour >= 9 && context.time.hour < 17 && context.source_ip.isInRange(ip("10.0.0.0/8")) };'
3. Write a forbid policy to block access outside business hours regardless of other permits: 'forbid(principal, action == Action::"Write", resource) when { context.time.hour < 9 || context.time.hour >= 17 };'
4. Pass the authorization request with context fields: {"principal": "User::alice", "action": "Action::Read", "resource": "Document::doc1", "context": {"time": {"hour": 10}, "source_ip": "10.1.2.3"}}
5. Evaluate using the Cedar CLI: 'cedar authorize --policies policies.cedar --entities entities.json --request request.json'
6. In application code using the Rust or Java Cedar SDK, call 'Authorizer::is_authorized(request, policies, entities)' and handle the Decision enum (Allow/Deny)