diff --git a/func/sanitech_access_control.tf b/func/sanitech_access_control.tf
new file mode 100644
index 0000000..54da88c
--- /dev/null
+++ b/func/sanitech_access_control.tf
@@ -0,0 +1,13 @@
+resource "azurerm_role_assignment" "example" {
+  scope              = data.azurerm_subscription.primary.id
+  role_definition_id = data.azurerm_role_definition.example.id
+  principal_id       = data.azurerm_client_config.current.object_id
+}
+
+data "azurerm_role_definition" "example" {
+  name = "Contributor"
+}
+
+data "azurerm_subscription" "primary" {}
+
+data "azurerm_client_config" "current" {}