policy.json

{
    "context_is_admin":  "role:admin",
    "admin_or_owner":  "is_admin:True or project_id:%(project_id)s",
    "default": "rule:admin_or_owner",
    "admin_api": "rule:context_is_admin",
    "admin_or_user": "is_admin:True or user_id:%(user_id)s",

    "bay:create": "rule:default",
    "bay:delete": "rule:default",
    "bay:detail": "rule:default",
    "bay:get": "rule:default",
    "bay:get_all": "rule:default",
    "bay:update": "rule:default",

    "baymodel:create": "rule:default",
    "baymodel:delete": "rule:default",
    "baymodel:detail": "rule:default",
    "baymodel:get": "rule:default",
    "baymodel:get_all": "rule:default",
    "baymodel:update": "rule:default",
    "baymodel:publish": "rule:admin_or_owner",

    "rc:create": "rule:default",
    "rc:delete": "rule:default",
    "rc:detail": "rule:default",
    "rc:get": "rule:default",
    "rc:get_all": "rule:default",
    "rc:update": "rule:default",

    "container:create": "rule:admin_or_user",
    "container:delete": "rule:admin_or_user",
    "container:detail": "rule:default",
    "container:get": "rule:default",
    "container:get_all": "rule:default",
    "container:update": "rule:admin_or_user",

    "certificate:create": "rule:admin_or_user",
    "certificate:get": "rule:admin_or_user",

    "magnum-service:get_all": "rule:admin_api"
}