permissions:
  policies:
    DeferredAffiliation:
      roles:
        - Admin
        - User
        - Manager
        - DescriptionTemplateEditor
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    # Tenants
    BrowseTenant:
      roles:
        - Admin
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    EditTenant:
      roles:
        - Admin
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    DeleteTenant:
      roles:
        - Admin
      claims: [ ]
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    AllowNoTenant:
      roles:
        - Admin
      claims: [ ]
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    # Users
    BrowseUser:
      roles:
        - Admin
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    EditUser:
      roles:
        - Admin
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    DeleteUser:
      roles:
        - Admin
      claims: [ ]
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    #Annotation
    BrowseAnnotation:
      roles:
        - Admin
      entityAffiliated: true
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    NewAnnotation:
      roles:
        - Admin
      entityAffiliated: true
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    EditAnnotation:
      roles:
        - Admin
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    DeleteAnnotation:
      roles:
        - Admin
      entityAffiliated: false
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    #Tenant Configuration
    BrowseTenantConfiguration:
      roles:
        - Admin
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    EditTenantConfiguration:
      roles:
        - Admin
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false