{
    "global_readonly": "(role:global_readonly)",
    "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)",
    "_member_role": "(role:member or role:_member_)",
    "member": "(project_id:%(project_id)s and rule:_member_role)",
    "admin": "(is_admin:True or role:admin)",
    "owner": "(user_id:%(user_id)s and rule:_member_role)",

    "creator": "(project_id:%(created_by_project_id)s and (rule:_member_role or role:service))",
    "resource_owner": "(project_id:%(project_id)s and (rule:_member_role or role:service))",
    "metric_owner": "(project_id:%(resource.project_id)s and (rule:_member_role or role:service))",

    "get status": "rule:admin or rule:readonly",

    "create resource": "rule:admin or rule:member or rule:resource_owner",
    "get resource": "rule:creator or rule:resource_owner or rule:readonly",
    "update resource": "rule:admin or rule:creator",
    "delete resource": "rule:admin or rule:creator",
    "delete resources": "rule:admin or rule:creator",
    "list resource": "rule:admin or rule:creator or rule:resource_owner or rule:readonly",
    "search resource": "rule:admin or rule:creator or rule:resource_owner or rule:readonly",

    "create resource type": "rule:admin",
    "delete resource type": "rule:admin",
    "update resource type": "rule:admin",
    "list resource type": "rule:admin or rule:member or rule:readonly",
    "get resource type": "rule:admin or rule:member or rule:readonly",

    "get archive policy": "rule:admin or rule:member or rule:readonly",
    "list archive policy": "rule:admin or rule:member or rule:readonly",
    "create archive policy": "rule:admin",
    "update archive policy": "rule:admin",
    "delete archive policy": "rule:admin",

    "create archive policy rule": "rule:admin",
    "get archive policy rule": "rule:admin or rule:member or rule:readonly",
    "list archive policy rule": "rule:admin or rule:member or rule:readonly",
    "delete archive policy rule": "rule:admin",

    "create metric": "rule:admin or rule:member or rule:metric_owner",
    "delete metric": "rule:admin or rule:creator",
    "get metric": "rule:admin or rule:creator or rule:metric_owner or rule:readonly",
    "search metric": "rule:admin or rule:creator or rule:metric_owner or rule:readonly",
    "list metric": "rule:admin or rule:member or rule:readonly",
    "list all metric": "rule:admin or rule:readonly",

    "get measures":  "rule:admin or rule:creator or rule:metric_owner or rule:readonly",
    "post measures":  "rule:admin or rule:creator"
}