check(project.path == ":") {
                // We rely on the fact that root is configured first
                "BuildEnvironmentService should be registered by the root"
            }
            parameters.rootProjectDir = this@with
            parameters.rootProjectBuildDir = project.layout.buildDirectory
        }

```

### 2. Create a sample OPA Policy

In another terminal, create a policy that allows root user all access and for all other users denies `PutObject`:

```sh
cat > example.rego <<EOF
package httpapi.authz

import input

default allow = false

# Allow the root user to perform any action.
allow {
 input.owner == true
}

# All other users may do anything other than call PutObject

     */
    @Nonnull
    Path topDirectory();

    /**
     * Returns the root directory of the Maven invocation, if found. This is determined by the presence of a
     * {@code .mvn} directory or a POM with the root="true" property but is not always applicable (ie invocation
     * from outside a checkout).
     *
     * @return the root directory path, if present
     */
    @Nonnull
    Optional<Path> rootDirectory();

        @Test
        @DisplayName("list with null root throws NullPointerException")
        void list_withNullRoot_throwsNpe() {
            // Intent: null root is invalid input
            assertThrows(NullPointerException.class, () -> SmbEnumerationUtil.list(null, "*", 0, null, null));
        }

        @Test
        @DisplayName("listFiles with null root throws NullPointerException")

    @Test
    void testThrowableConstructor() {
        // Test the constructor with a cause
        Throwable cause = new RuntimeException("Root cause of timeout");
        ConnectionTimeoutException exception = new ConnectionTimeoutException(cause);
        assertEquals("java.lang.RuntimeException: Root cause of timeout", exception.getMessage(),
                "Message should be derived from the cause");

        // Scenario: DFS is disabled.
        when(mockConfig.isDfsDisabled()).thenReturn(true);
        assertNull(dfsImpl.resolve(mockContext, "domain", "root", "/path"));
    }

    @Test
    void testResolve_NullRoot() throws SmbAuthException {
        // Scenario: The root is null.
        assertNull(dfsImpl.resolve(mockContext, "domain", null, "/path"));
    }

    @Test

#   TF_BISECT_BAD: First bad commit (e.g. commit from the first failing job)
#   TF_BISECT_SCRIPT: The build script path relative to the TF root dir, e.g.
#     ci/official/wheel.sh
#   TFCI: The env config path, relative to the TF root dir, e.g.
#     ci/official/envs/an_env_config
#
# Note that you can combine bisect.sh with any.sh to bisect a single test:
#
#   export TFCI=...

     * Indicates a target set boundary in the referral response.
     */
    public static final int FLAGS_TARGET_SET_BOUNDARY = 0x0004;
    /**
     * Indicates root targets in the DFS referral.
     */
    public static final int TYPE_ROOT_TARGETS = 0x0;
    /**
     * Indicates non-root targets in the DFS referral.
     */
    public static final int TYPE_NON_ROOT_TARGETS = 0x1;

   *
   * <p>This fit minimizes the root-mean-square error in {@code y} as a function of {@code x}. This
   * error is defined as the square root of the mean of the squares of the differences between the
   * actual {@code y} values of the data and the values predicted by the fit for the {@code x}
   * values (i.e. it is the square root of the mean of the squares of the vertical distances between

     */
    boolean shouldForceSigning();

    /**
     * Determines whether this resource path overlaps with another resource path by sharing a common root.
     *
     * @param other the other resource locator to compare with
     * @return whether the paths share a common root
     * @throws CIFSException if an error occurs during comparison
     */
    boolean overlaps(SmbResourceLocator other) throws CIFSException;

    /**