output "role_assignment_ids" {
  value       = { for role, ra in azurerm_role_assignment.role : role => ra.id }
  description = "IDs of unconditional role assignments, keyed by role definition name."
}

output "rbac_admin_role_assignment_id" {
  value       = length(azurerm_role_assignment.rbac_admin) > 0 ? azurerm_role_assignment.rbac_admin[0].id : null
  description = "ID of the constrained RBAC Administrator role assignment, or null when delegable_roles is empty."
}

output "rbac_admin_condition" {
  value       = length(azurerm_role_assignment.rbac_admin) > 0 ? local.rbac_admin_condition : null
  description = "Rendered condition used for the constrained RBAC Administrator assignment, or null when not created."
}