model:
[request_definition]
r = sub, obj, act, exp
[policy_definition]
p = sub, obj, act
[role_definition]
g = _, _
[policy_effect]
e = some(where (p.eft == allow))
[matchers]
m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act && r.exp == "1"
policy:
p, reader, data, read
p, writer, data, write
p, admin, data, delete
g, alice, reader
g, alice, writer
g, bob, reader
g, cathy, admin
request(s):
alice, data, read, 1
alice, data, write, 2
alice, data, delete, 3
bob, data, write, 4
