ACL settings for securing User model in Loopback

ACL for User model

[
    {
        "principalType": "ROLE",
        "principalId": "$everyone",
        "permission": "DENY"
    }, {
        "principalType": "ROLE",
        "principalId": "$everyone",
        "permission": "ALLOW",
        "property": "create"
    },
    {
        "principalType": "ROLE",
        "principalId": "$everyone",
        "permission": "ALLOW",
        "property": "login"
    },
    {
        "principalType": "ROLE",
        "principalId": "$everyone",
        "permission": "ALLOW",
        "property": "logout"
    },
    {
        "principalType": "ROLE",
        "principalId": "$everyone",
        "permission": "ALLOW",
        "property": "confirm"
    },
    {
        "principalType": "ROLE",
        "principalId": "admin",
        "permission": "ALLOW",
        "property": "deleteById"
    },
    {
        "principalType": "ROLE",
        "principalId": "admin",
        "permission": "ALLOW",
        "property": "exists"
    },
    {
        "principalType": "ROLE",
        "principalId": "admin",
        "permission": "ALLOW",
        "property": "find"
    },
    {
        "principalType": "ROLE",
        "principalId": "admin",
        "permission": "ALLOW",
        "property": "findById"
    },
    {
        "principalType": "ROLE",
        "principalId": "admin",
        "permission": "ALLOW",
        "property": "upsert"
    }, {
        "principalType": "ROLE",
        "principalId": "admin",
        "permission": "ALLOW",
        "property": "updateAll"
    },    
    {
        "principalType": "ROLE",
        "principalId": "$owner",
        "permission": "ALLOW",
        "property": "updateAttributes"
    }  
],