[request_definition]
r = identity, system, api, act

[policy_definition]
p = identity, system, api, act

[role_definition]
g = _, _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.identity, p.identity, r.system) && r.system == p.system && keyMatch3(r.api, p.api) && regexMatch(r.act, p.act)