website/docs: add docs for source switch expression policy

website/docs/customize/policies/expression.mdx

@@ -2,9 +2,9 @@
 title: Expression Policies
 ---
 
-Expression policies are perhaps the most flexible way to define specific implementations of flows and stages. With Expression polices, you can provide Python code to enforce custom checks and validation.
+Expression policies are perhaps the most flexible way to define specific implementations of flows and stages. When you [create](./working_with_policies.md#create-a-policy) an expression policy, you provide your own custom Python code to enforce custom checks and validation.
 
-The passing of the policy is determined by the return value of the code.
+The passing of the policy is determined by the return value of the code: `True` or `False`.
 
 To pass a policy, use:
 
@@ -29,7 +29,16 @@ return False
 
 If the return is `True` that means Yes, use this stage (i.e. the user will get the MFA prompt). A return of `False` means remove this stage from the plan.
 
-## Available Functions
+## Sample expression policies
+
+Expressions policies with sample Python that we have documented:
+
+- [Source-switching based on email address](./expression/source_switch.md)
+- [Managing flow context keys](./expression/managing_flow_context_keys.md)
+- [Unique email addresses](./expression/unique_email.md)
+- [Create an email address allow list](./expression/whitelist_email.md)
+
+## Available functions
 
 ### `ak_message(message: str)`
 

website/docs/customize/policies/expression/source_switch.md

@@ -0,0 +1,33 @@
+---
+title: Switch which source is used based on email address
+---
+
+You can use an expression policy to determine with [source](../../../../users-sources/sources/) (a set of user credentials and data, stored in authentik, Google, GitHub, etc) is used for a particular user, based on which email address the user enters when they log in and authenticate (using the authn flow).
+
+To define which source is used for a specific user, [create an expression policy](../working_with_policies.md#create-a-policy) that defines the possible options for the source, and the logic to determine the domain based on the email address and then "switch" the user to the desired source.
+
+## Example expression
+
+```python
+# This is a mapping of domains to sources
+# the key is a domain for the user and the value is the `slug` of the source to redirect to
+source_email_map = {
+    "foo.bar.com": "entra-foo",
+    "bar.baz.com": "entra-bar",
+}
+
+user_email = request.context["pending_user_identifier"]
+
+_username, _, domain = user_email.partition("@")
+source = source_email_map.get(domain)
+if not source:
+    return True
+plan = request.context.get("flow_plan")
+if not plan:
+    return False
+# For OIDC
+# plan.redirect(f"/source/oauth/login/{source}/")
+# For SAML
+plan.redirect(f"/source/saml/{source}")
+return False
+```

website/docs/customize/policies/index.md

@@ -8,11 +8,13 @@ In effect, policies determine whether or not a specific stage is applied to a fl
 
 For example, you can create a policy that, for certain users, skips over a stage that prompts for MFA input. Or, you can define a policy that allows users to access a login flow only if the policy criteria are met. See below for other policies, including the reputation policy and an events-driven policy to manage notifications.
 
+## Create and manage policies
+
 For instructions about creating and binding policies to flows and stages, refer to ["Working with policies](./working_with_policies.md)".
 
 ## Standard policies
 
-The following policies are our standard, out-of-the box policies.
+Following are our standard, out-of-the box policies that you can [create and customize](./working_with_policies.md) as needed.
 
 ### Event-matcher policy
 
@@ -61,7 +63,7 @@ The following rules can be set:
 - Minimum length.
 - Symbol charset (define which characters are counted as symbols).
 
-Starting with authentik 2022.11.0, the following checks can also be done with this policy:
+The following checks can also be done with this policy:
 
 - Check the password hash against the database of [Have I Been Pwned](https://haveibeenpwned.com/). Only the first 5 characters of the hashed password are transmitted, the rest is compared in authentik
 - Check the password against the password complexity checker [zxcvbn](https://github.com/dropbox/zxcvbn), which detects weak password on various metrics.

website/docs/customize/policies/working_with_policies.md

@@ -4,19 +4,21 @@ title: Working with policies
 
 For an overview of policies, refer to our documentation on [Policies](./index.md).
 
-authentik provides several [standard policy types](./index.md#standard-policies), which can be configured for your specific needs.
+authentik provides several [standard policy types](./index.md#standard-policies), which can be configured for your specific needs. We also document several useful [expression policies](./expression.mdx#sample-expression-policies).
 
-We also document how to use a policy to [whitelist email domains](./expression/whitelist_email.md) and to [ensure unique email addresses](./expression/unique_email.md).
+::info
+You can add expressions to our standard policies to further customize them.
+:::
 
 To learn more see also [bindings](../../add-secure-apps/flows-stages/bindings/index.md) and how to [bind policy bindings to a new application when the application is created](../../add-secure-apps/applications/manage_apps.mdx#instructions) (for example, to configure application-specific access).
 
 ## Create a policy
 
-To create a new policy, follow these steps:
+To create a new policy, _either a pre-configured one or an expression policy_, follow these steps:
 
 1. Log in as an admin to authentik, and go to the Admin interface.
 2. In the Admin interface, navigate to **Customization > Policies**.
-3. Click **Create**, and select the type of policy.
+3. Click **Create**, and select the type of policy. Here you select whether you want to create a custom expression policy, or a standard, out-of-the box one.
 4. Define the policy and click **Finish**.
 
 ## Bind a policy to a flow or stage

website/docs/sidebar.mjs

@@ -383,8 +383,9 @@ const items = [
                         },
                         items: [
                             "customize/policies/expression/unique_email",
-                            "customize/policies/expression/whitelist_email",
                             "customize/policies/expression/managing_flow_context_keys",
+                            "customize/policies/expression/source_switch",
+                            "customize/policies/expression/whitelist_email",
                         ],
                     },
                     "customize/policies/unique_password",