permissions:
  extendedClaims: [ ]
  policies:

    # Tenants
    BrowseTenant:
      roles:
        - ic-sti-superuser
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    EditTenant:
      roles:
        - ic-sti-superuser
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    DeleteTenant:
      roles:
        - ic-sti-superuser
      claims: [ ]
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    AllowNoTenant:
      roles:
        - ic-sti-superuser
      claims: [ ]
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    # Users
    BrowseUser:
      roles:
        - ic-sti-superuser
        - tenantadmin
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    EditUser:
      roles:
        - admin
        - ic-sti-superuser
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    DeleteUser:
      roles:
        - ic-sti-superuser
      claims: [ ]
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    # UserContactInfo
    BrowseUserContactInfo:
      roles:
        - ic-sti-superuser
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    EditUserContactInfo:
      roles:
        - ic-sti-superuser
        - user
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    DeleteUserContactInfo:
      roles:
        - ic-sti-superuser
      claims: [ ]
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    #Notification
    BrowseNotification:
      roles:
        - ic-sti-superuser
        - user
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    EditNotification:
      roles:
        - ic-sti-superuser
        - user
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    #Tenant Configuration
    BrowseTenantConfiguration:
      roles:
        - ic-sti-superuser
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    EditTenantConfiguration:
      roles:
        - ic-sti-superuser
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    #User Notification Preference
    BrowseUserNotificationPreference:
      roles:
        - ic-sti-superuser
      clients: [ ]
      allowAnonymous: true
      allowAuthenticated: false
    EditUserNotificationPreference:
      roles:
        - ic-sti-superuser
        - user
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
  
    # ViewPage Permissions
    ViewNotificationPage:
      roles:
        - ic-sti-superuser
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    ViewNotificationEventRulePage:
      roles:
        - ic-sti-superuser
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    ViewInAppNotificationPage:
      roles:
        - ic-sti-superuser
        - tenantadmin
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false
    ViewNotificationTemplatePage:
      roles:
        - ic-sti-superuser
      clients: [ ]
      allowAnonymous: false
      allowAuthenticated: false