
      "*": deny
      read: allow