{
  "admin": "role:admin or is_admin:True",
  "primary_zone": "target.zone_type:SECONDARY",

  "owner": "tenant:%(tenant_id)s",
  "admin_or_owner": "rule:admin or rule:owner",
  "target": "tenant:%(target_tenant_id)s",
  "owner_or_target":"rule:target or rule:owner",
  "admin_or_owner_or_target":"rule:owner_or_target or rule:admin",
  "admin_or_target":"rule:admin or rule:target",

  "zone_primary_or_admin": "('PRIMARY':%(zone_type)s and rule:admin) OR ('SECONDARY':%(zone_type)s AND is_admin:True)",

  "default": "rule:admin_or_owner",

  "all_tenants": "rule:admin",

  "edit_managed_records" : "rule:admin",

  "use_low_ttl": "rule:admin",

  "get_quotas": "rule:admin_or_owner",
  "get_quota": "rule:admin_or_owner",
  "set_quota": "rule:admin",
  "reset_quotas": "rule:admin",

  "create_tld": "rule:admin",
  "find_tlds": "rule:admin",
  "get_tld": "rule:admin",
  "update_tld": "rule:admin",
  "delete_tld": "rule:admin",

  "create_tsigkey": "rule:admin",
  "find_tsigkeys": "rule:admin",
  "get_tsigkey": "rule:admin",
  "update_tsigkey": "rule:admin",
  "delete_tsigkey": "rule:admin",

  "find_tenants": "rule:admin",
  "get_tenant": "rule:admin",
  "count_tenants": "rule:admin",

  "create_zone": "rule:admin",
  "get_zones": "rule:admin",
:$
  "create_pool": "rule:admin",
  "find_pools": "rule:admin",
  "find_pool": "rule:admin",
  "get_pool": "rule:admin",
  "update_pool": "rule:admin",
  "delete_pool": "rule:admin",
  "zone_create_forced_pool": "rule:admin",

  "diagnostics_ping": "rule:admin",
  "diagnostics_sync_zones": "rule:admin",
  "diagnostics_sync_zone": "rule:admin",
  "diagnostics_sync_record": "rule:admin",

  "create_zone_transfer_request": "rule:admin",
  "get_zone_transfer_request": "rule:admin or tenant:%(target_tenant_id)s or None:%(target_tenant_id)s",
  "get_zone_transfer_request_detailed": "rule:admin",
  "find_zone_transfer_requests": "@",
  "find_zone_transfer_request": "@",
  "update_zone_transfer_request": "rule:admin",
  "delete_zone_transfer_request": "rule:admin",

  "create_zone_transfer_accept": "rule:admin or tenant:%(target_tenant_id)s or None:%(target_tenant_id)s",
  "get_zone_transfer_accept": "rule:admin",
  "find_zone_transfer_accepts": "rule:admin",
  "find_zone_transfer_accept": "rule:admin",
  "update_zone_transfer_accept": "rule:admin",
  "delete_zone_transfer_accept": "rule:admin",

  "create_zone_import": "rule:admin",
  "find_zone_imports": "rule:admin",
  "get_zone_import": "rule:admin",
  "update_zone_import": "rule:admin",
  "delete_zone_import": "rule:admin",

  "zone_export": "rule:admin",
  "create_zone_export": "rule:admin",
  "find_zone_exports": "rule:admin",
  "get_zone_export": "rule:admin",
  "update_zone_export": "rule:admin",

  "find_service_status": "rule:admin",
  "find_service_statuses": "rule:admin",
  "update_service_service_status": "rule:admin"
}