gistfile1.txt

---

description: Limited RUN access to Web Services Group
context:
  project: 'Support'
for:
  event:
    - equals:
        group: 'Web Services'
        name: 'Restart OCE'
      allow: [read]
  job:
    - equals:
        group: 'Web Services'
        name: 'Restart OCE'
      allow: [read,run]
  node:
    - allow: '*'
by:
  username: ['myusername']

This will allow the Web services group to read events, but I'm not sure if you can restrict it only to the 'Restart OCE' job events

---

for:
  resource:
  - allow: read
    equals:
      kind: event
description: Allows myuser to read events
context:
  project: Support
by:
  username: myuser