Authorize with one or another policies

Product

Hot Chocolate

Is your feature request related to a problem?

I have an API that i need to acces when the user has one or another Permission.

Iam adding a Claim called permissions to the token that is a list of strings.
This is the way iam handling the Authorization

var permissionsClaim = context.User.FindFirst(c => c.Type == "permissions")?.Value;

if (permissionsClaim == null)
{
    return Task.CompletedTask;
}

var permissions = !string.IsNullOrEmpty(permissionsClaim) ?
    JsonConvert.DeserializeObject<List<string>>(permissionsClaim) :
    new List<string>();

if (permissions.Contains(requirement.Permission) || permissions.Contains("SUPERADMIN"))
{
    context.Succeed(requirement);
}

return Task.CompletedTask;

This is my API

[Authorize(Policy = "BRANCH.GET")]
public async Task<List<BranchResponse>> GetBranch(CancellationToken cancellationToken)
{
    return await _mediator.Send(new GetBranchCommand(), cancellationToken);
}

I want to acces this endpoint if the user has as permission BRANCH.GET or BRANCH.CREATE, but i didnt found a way to do so.

The solution you'd like

The best solution would be something like this

[Authorize(Policy = "BRANCH.GET", BRANCH.CREATE)]
API 

No repository files or tests are identified in the issue. Start by tracing how the shown C# Authorize policy is handled for Hot Chocolate endpoints, then determine how multiple policies should express OR semantics and verify access when either BRANCH.GET or BRANCH.CREATE is present.