The controlling policy, which grants admin users the ability to bind to restricted services, takes the form of the following two rules:

controlling-policy.go

on job::/ {
    if (PV->SvcGroups.category == restricted &&
        service == PV->SvcGroups.service &&
        role == admin)
    {
       permit bind
    }
}

on service::/ {
    if (PV->SvcGroups.category == restricted &&
        query->target_str == PV->SvcGroups.service &&
        role == admin)
    {
       permit bind
    }
}