Firebase Rules Examples

private_items.json

// Supports pushing new items
"private": {
  ".read": false,
  ".write": false,
  "$item": {
    ".read": "auth != null && auth.uid == data.child('uid').val()",
    ".write": "auth != null && 
      /*update*/ ((data.exists() && auth.uid == data.child('uid').val()) 
      /*new*/ ||  (!data.exists() && auth.uid == newData.child('uid').val()))"
  }
}

protected_group.json

//http://stackoverflow.com/questions/15079163/how-can-i-use-firebase-to-securely-share-presence-data-within-a-specific-group/15079164#15079164
// Protecting a group by checking if a user is part of the group
{
  "groups": {
    "$groupid": {
      // Users can view the presence state of users in this group if they
      // are authenticated and listed in the group themselves.
      ".read": "auth != null && data.child('users').hasChild(auth.id)",
       // Only admins can create new groups.
      ".write": "auth != null && auth.isAdmin === true",
      "users": {
        "$userid": {
          // Users can update only their individual account data.
          ".write": "auth != null && $userid == auth.id && newData.val() != null"
        }
      }
    }
  }
}

Thx for sharing. Firebase docs really lack those examples.