acl

const (
	// The following levels are the only valid values for the `policy = "read"` stanza.
	// When policies are merged together, the most privilege is granted, except for deny
	// which always takes precedence and supercedes.
	PolicyDeny  = "deny"
	PolicyRead  = "read"
	PolicyWrite = "write"
)

const (
	// The following are the fine-grained capabilities that can be granted within a namespace.
	// The Policy stanza is a short hand for granting several of these. When capabilities are
	// combined we take the union of all capabilities. If the deny capability is present, it
	// takes precedence and overwrites all other capabilities.
	NamespaceCapabilityDeny             = "deny"
	NamespaceCapabilityListJobs         = "list-jobs"
	NamespaceCapabilityReadJob          = "read-job"
	NamespaceCapabilitySubmitJob        = "submit-job"
	NamespaceCapabilityDispatchJob      = "dispatch-job"
	NamespaceCapabilityReadLogs         = "read-logs"
	NamespaceCapabilityReadFS           = "read-fs"
	NamespaceCapabilitySentinelOverride = "sentinel-override"
)