policy default deny
allow	uid=500	rspec	foo=bar and bar=foo	rspec