{
    "deny_readonly": "not role:readonly",
    "admin_or_creator": "role:admin or project_id:%(created_by_project_id)s",
    "resource_owner": "project_id:%(project_id)s",
    "metric_owner": "project_id:%(resource.project_id)s",

    "get status": "role:admin",

    "create resource": "rule:deny_readonly",
    "get resource": "rule:admin_or_creator or rule:resource_owner",
    "update resource": "rule:admin_or_creator",
    "delete resource": "rule:admin_or_creator",
    "delete resources": "rule:admin_or_creator",
    "list resource": "rule:admin_or_creator or rule:resource_owner",
    "search resource": "rule:admin_or_creator or rule:resource_owner",

    "create resource type": "role:admin",
    "delete resource type": "role:admin",
    "update resource type": "role:admin",
    "list resource type": "",
    "get resource type": "",

    "get archive policy": "",
    "list archive policy": "",
    "create archive policy": "role:admin",
    "update archive policy": "role:admin",
    "delete archive policy": "role:admin",

    "create archive policy rule": "role:admin",
    "get archive policy rule": "",
    "list archive policy rule": "",
    "delete archive policy rule": "role:admin",

    "create metric": "rule:deny_readonly",
    "delete metric": "rule:admin_or_creator",
    "get metric": "rule:admin_or_creator or rule:metric_owner or role:readonly",
    "search metric": "rule:admin_or_creator or rule:metric_owner",
    "list metric": "",
    "list all metric": "role:admin or role:readonly",

    "get measures":  "rule:admin_or_creator or rule:metric_owner or role:readonly",
    "post measures":  "rule:admin_or_creator"
}