[request_definition]
r = subject, domain, action, object

[policy_definition]
p = subject, domain, action, object

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m =\
  (\
    (p.subject == "*" || r.subject == p.subject || regexMatch(r.subject, p.subject))\
    && (p.domain == "*" || r.domain == p.domain)\
    && (p.action == "*" || regexMatch(r.action, p.action))\
    && keyMatch(r.object, p.object)\
  )