The hard part is what source do you use for your users?
Are they listed in the local /etc/passwd file, are they in
an LDAP compliant directory? Is this cfagent.conf file going to
run on one mail server or many ?
If it is one mail server then you can make a list variable
myname = ( name01:name02:name03 )
Then the following can be used
#This would take care of the files being in compliance.
files:
/var/spool/mail/${myname}
owner=${myname}
mode=660
action=warnall
syslog=true
To iterate over a list, see the following url:
http://www.cfengine.org/docs/cfengine-Tutorial.html#Iterating-over-lists
#Next comes seeing if an extra file is in the directory which should not
be in the directory.
/var/spool/mail/${myname}
exclude=${myname}
action=warnall
syslog=true
I have not tested this last one. Give it a try.
May need to define an "elsedefine=class" to do more here.