What you will do
You will run the prepared expression in the playground above, change one input at a time, and explain the result. Start in CEL only, then repeat the same rule in CEL + JSON.
How it works
The expression contains two independent questions. The in operator checks whether role equals an item in the list. The && operator then requires that result and active both be true. CEL short-circuits &&: if the left side is false, the complete result is already known.
Read the prepared example
The CEL + JSON rule is:
role in ['editor', 'admin'] && activeIts input is:
{
"role": "editor",
"active": true
}The CEL only tab contains the values and the rule in one expression. The enabled cel.bind() extension keeps each name local to its final argument.
Evaluation step by step
'editor' in ['editor', 'admin']returnstrue.activeistrue.- Both sides of
&&are true, so the result istrue.
Your task
- Run the initial expression.
- Change
roletoviewerand explain the new result. - Restore
editor, changeactivetofalse, and run again.
Expected observation: Either change makes the whole expression return false.
Common mistake
Reading the condition as one long sentence hides which part failed. Evaluate each side of && separately when debugging.
Show the explanation
The role must occur in the allowed list and active must also be true.
Knowledge check
What must be true for the full expression to return true?
Key takeaway
Split compound logic at && and ||; each side must have a clear boolean meaning.
Sources
CEL-DEV— official CEL overview.CEL-LANG— official CEL language definition.CEL-GO-BIND— official documentation for the optionalcel.bind()extension used by the self-contained tab.