{
    "default": "!",

    "admin": "role:admin and tenant:admin or role:admin and tenant:service or role:admin_image and tenant:admin or role:admin_image and tenant:service",
    "admin_support": "role:admin_support and tenant:admin or role:admin_support and tenant:service",
    "admin_viewer": "role:admin_viewer and tenant:admin or role:admin_viewer and tenant:service",

    "admin_or_support": "rule:admin or rule:admin_support",
    "admin_or_support_or_viewer": "rule:admin or rule:admin_support or rule:admin_viewer",

    "image:create": "rule:admin_or_support",
    "image:list": "rule:admin_or_support_or_viewer",
    "image:get_one": "rule:admin_or_support_or_viewer",
    "image:update": "rule:admin",
    "image:delete": "rule:admin",
    "image:enable": "rule:admin_or_support",

    "region:create": "rule:admin_or_support",
    "region:update": "rule:admin",
    "region:delete": "rule:admin",

    "tenant:create": "rule:admin_or_support",
    "tenant:update": "rule:admin",
    "tenant:delete": "rule:admin",

    "metadata:create": "rule:admin_or_support"
}