{
  "admin": "is_admin:True or (role:admin and is_admin_project:True)",
  "owner": "project_id:%(project_id)s",
  "circle_admin": "role:circle_admin and project_id:%(project_id)s",

  "template:create": "rule:admin or rule:owner or rule:circle_admin",

  "request:decide": "rule:admin or rule:circle_admin"
}