feat(rbac)!: add Azure RBAC engine, FFI API, and cross-language tests

CHANGELOG.md

@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Azure RBAC condition interpreter with builtin evaluation coverage and YAML test suite, including quantifier (ForAnyOfAnyValues/ForAllOfAllValues), datetime (DateTimeEquals), IP (IpInRange), GUID (GuidEquals), list (ListContains), and string (StringEquals) semantics.
+- FFI surface for Azure RBAC condition evaluation (see bindings changelog for language-specific wrappers).
+
 ## [0.9.1](https://github.com/microsoft/regorus/compare/regorus-v0.9.0...regorus-v0.9.1) - 2026-02-06
 
 ### Fixed

Cargo.toml

@@ -25,7 +25,7 @@ default = ["full-opa", "arc", "rvm"]
 arc = []
 ast = []
 azure_policy = ["dep:jsonschema", "arc", "dashmap"]
-azure-rbac = []
+azure-rbac = ["regex", "time", "net"]
 base64 = ["dep:data-encoding"]
 base64url = ["dep:data-encoding"]
 coverage = []

bindings/csharp/Directory.Packages.props

@@ -10,5 +10,6 @@
     <PackageVersion Include="Regorus" Version="$(RegorusPackageVersion)$(RegorusPackageVersionSuffix)" />
     <PackageVersion Include="MSTest" Version="3.8.2" />
     <PackageVersion Include="System.Text.Json" Version="8.0.5" />
+    <PackageVersion Include="YamlDotNet" Version="13.7.0" />
   </ItemGroup>
 </Project>

bindings/csharp/README.md

@@ -104,3 +104,49 @@ vm.SetInputJson(Input);
 var result = vm.Execute();
 Console.WriteLine($"allow: {result}");
 ```
+
+## Azure RBAC Condition Evaluation
+
+Evaluate Azure RBAC condition expressions directly with a JSON evaluation context:
+
+```csharp
+using Regorus;
+
+const string Condition = "@Resource[owner] StringEquals 'alice'";
+const string ContextJson = """
+{
+  "principal": {
+    "id": "user-1",
+    "principal_type": "User",
+    "custom_security_attributes": {}
+  },
+  "resource": {
+    "id": "/subscriptions/s1",
+    "resource_type": "Microsoft.Storage/storageAccounts",
+    "scope": "/subscriptions/s1",
+    "attributes": {
+      "owner": "alice",
+      "confidential": true
+    }
+  },
+  "request": {
+    "action": "Microsoft.Storage/storageAccounts/read",
+    "data_action": null,
+    "attributes": {
+      "clientIP": "10.0.0.1"
+    }
+  },
+  "environment": {
+    "is_private_link": null,
+    "private_endpoint": null,
+    "subnet": null,
+    "utc_now": "2023-05-01T12:00:00Z"
+  },
+  "action": "Microsoft.Storage/storageAccounts/read",
+  "suboperation": null
+}
+""";
+
+var allowed = RbacEngine.EvaluateCondition(Condition, ContextJson);
+Console.WriteLine($"RBAC condition allowed: {allowed}");
+```