policy default deny
allow	uid=500	*	foo=bar	*