{
    "ietf-netconf-acm:nacm": {
	"enable-nacm": true,
	"read-default": "permit",
	"write-default": "permit",
	"exec-default": "permit",
	"groups": {
	    "group": [
		{
		    "name": "admin",
		    "user-name": [
			"admin"
		    ]
		},
		{
		    "name": "operator",
		    "user-name": []
		},
		{
		    "name": "guest",
		    "user-name": []
		}
	    ]
	},
	"rule-list": [
	    {
		"name": "admin-acl",
		"group": [
		    "admin"
		],
		"rule": [
		    {
			"name": "permit-all",
			"module-name": "*",
			"access-operations": "*",
			"action": "permit",
			"comment": "Allow 'admin' group complete access to all operations and data."
		    }
		]
	    },
	    {
		"name": "operator-acl",
		"group": [
		    "operator"
		],
		"rule": [
		    {
			"name": "permit-system-rpcs",
			"module-name": "ietf-system",
			"rpc-name": "*",
			"access-operations": "exec",
			"action": "permit",
			"comment": "Operators can reboot, shutdown, and set system time."
		    }
		]
	    },
	    {
		"name": "guest-acl",
		"group": [
		    "guest"
		],
		"rule": [
		    {
			"name": "deny-all-write+exec",
			"module-name": "*",
			"access-operations": "create update delete exec",
			"action": "deny",
			"comment": "Guests cannot change anything or exec rpcs."
		    }
		]
	    },
	    {
		"name": "default-deny-all",
		"group": ["*"],
		"rule": [
		    {
			"name": "deny-password-access",
			"path": "/ietf-system:system/authentication/user/password",
			"access-operations": "*",
			"action": "deny",
			"comment": "No user except admins can access password hashes."
		    },
		    {
			"name": "deny-keystore-access",
			"module-name": "ietf-keystore",
			"access-operations": "*",
			"action": "deny",
			"comment": "No user except admins can access cryptographic keys."
		    },
		    {
			"name": "deny-truststore-access",
			"module-name": "ietf-truststore",
			"access-operations": "*",
			"action": "deny",
			"comment": "No user except admins can access trust store."
		    }
		]
	    }
	]
    }
}
