[request_definition] r = sub, act, obj r2 = sub, act [policy_definition] p = sub, act, obj p2 = sub, act [role_definition] g = _, _ g2 = _,_ [policy_effect] e = some(where (p.eft == allow)) e2 = some(where (p.eft == allow)) [matchers] m = r.sub == p.sub && g(p.act, r.act) && r.obj == p.obj m2 = r2.sub == p2.sub && g(p2.act, r2.act)