What you will do
You will run the prepared expression in the playground above, change one input at a time, and explain the result. Start in CEL only, then repeat the same rule in CEL + JSON.
How it works
exists_one() counts how many items make its predicate true and succeeds only when the count is exactly one. It is stricter than exists(): zero matches and two matches both return false. The predicate here reads the boolean active member of each map.
Read the prepared example
The CEL + JSON rule is:
approvers.exists_one(person, person.active)Its input is:
{
"approvers": [
{ "name": "A", "active": false },
{ "name": "B", "active": true }
]
}The CEL only tab contains the values and the rule in one expression. The enabled cel.bind() extension keeps each name local to its final argument.
Evaluation step by step
- Person A has
active: false. - Person B has
active: true. - Exactly one predicate result is true, so
exists_one()returnstrue.
Your task
- Run the example.
- Set both people to inactive.
- Then set both people to active and compare both false results.
Expected observation: Zero active people and two active people both fail the exactly-one requirement.
Common mistake
Do not use exists_one() when the rule actually means “at least one.” The macro encodes cardinality, not just presence.
Show the explanation
exists_one() returns false; exists() returns true.
Knowledge check
How is exists_one() different from exists() when two items match?
Key takeaway
Use exists_one() only when uniqueness is part of the rule.
Sources
CEL-DEV— official CEL overview.CEL-LANG— official CEL language definition.CEL-GO-BIND— official documentation for the optionalcel.bind()extension used by the self-contained tab.