#, policies
#, sub,               dom,                               obj,           act
p, repo:owner,        at://{did}/sh.tangled.repo/{rkey}, /,             write
p, repo:owner,        at://{did}/sh.tangled.repo/{rkey}, /collaborator, write
p, repo:collaborator, at://{did}/sh.tangled.repo/{rkey}, /settings,     write
p, repo:collaborator, at://{did}/sh.tangled.repo/{rkey}, /git,          write

p, server:owner,  /knot/{did}, /member, write
p, server:member, /knot/{did}, /git,    write

p, server:owner, /spindle/{did}, /member, write


#, group policies
#, sub,        role,              dom
g, repo:owner, repo:collaborator, at://{did}/sh.tangled.repo/{rkey}

g, server:owner, server:member, /knot/{did}
g, server:owner, server:member, /spindle/{did}