permissions:
  policies:
    DeferredAffiliation:
      roles:
        - TenantAdmin
        - TenantUser
        - TenantManager
        - TenantDescriptionTemplateEditor
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    # Tenants
    BrowseTenant:
      roles:
        - Admin
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    EditTenant:
      roles:
        - Admin
      clients: [ "opencdmp-api-dev" ]
      allowAnonymous: false
      allowAuthenticated: false
    DeleteTenant:
      roles:
        - Admin
      claims: [ ]
      clients: [ "opencdmp-api-dev" ]
      allowAnonymous: false
      allowAuthenticated: false
    AllowNoTenant:
      roles:
        - Admin
      claims: [ ]
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    # Users
    BrowseUser:
      roles:
        - TenantAdmin
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    EditUser:
      roles:
        - TenantAdmin
      clients: [ "opencdmp-api-dev" ]
      allowAnonymous: false
      allowAuthenticated: false
    DeleteUser:
      roles:
        - TenantAdmin
      claims: [ ]
      clients: [ "opencdmp-api-dev" ]
      allowAnonymous: false
      allowAuthenticated: false
    #Annotation
    BrowseAnnotation:
      roles:
        - TenantAdmin
      entityAffiliated: true
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    NewAnnotation:
      roles:
        - TenantAdmin
      entityAffiliated: true
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    EditAnnotation:
      roles:
        - TenantAdmin
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    DeleteAnnotation:
      roles:
        - TenantAdmin
      entityAffiliated: false
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    #Tenant Configuration
    BrowseTenantConfiguration:
      roles:
        - TenantAdmin
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    EditTenantConfiguration:
      roles:
        - TenantAdmin
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false