# Example of restricting domain creation to "admin" and "product_admin" (custom role created for product team).
keystone:create_domain: "rule:admin_required or role:product_admin"
keystone:delete_domain: "rule:admin_or_owner"

# Example of restriction actions within domain to user that created that domain
keystone:create_user: "rule:admin_or_owner"