BreadownRule takes a rule and builds an equivalent list of rules that each have at most one verb, one resource, and one resource name.

CompactRules combines rules that contain a single APIGroup/Resource, differ only by verb, and contain no other attributes.

ConfirmNoEscalation determines if the roles for a given user in a given namespace encompass the provided role.

Covers determines whether or not the ownerRules cover the servantRules in terms of allowed actions.

NewTestRuleResolver returns a rule resolver from lists of role objects.

StaticRoles is a rule resolver that resolves from lists of role objects.