Policy.yaml

#                                                                        #
# Security policy for the Cf.Shop package                                #
#                                                                        #

resources:
  methods:
    Cf_Shop: 'method(Cf\Shop\Controller\ShopController->.*Action())'
    Cf_Shop_ShopAdmin_Person: 'method(Cf\Shop\Controller\PersonController->.*Action())'
    Cf_Shop_ShopAdmin_Order:  'method(Cf\Shop\Controller\OrderController->.*Action())'

acls:
  Everybody:
    methods:
      Cf_Shop:                  GRANT

  'TYPO3.Neos:Editor':
    methods:
      Cf_Shop_ShopAdmin_Person: GRANT
      Cf_Shop_ShopAdmin_Order:  GRANT

Settings.yaml

security:
      enable: TRUE
      authenticationStrategy: allTokens
      authentication:
            providers:
              DefaultProvider:
                provider: PersistedUsernamePasswordProvider
                entryPoint: 'WebRedirect'
                entryPointOptions:
                  routeValues:
                    '@package':     'TYPO3.Neos'
                    '@controller':  'Login'
                    '@action':  'index'
      authorization:
        accessDecisionVoters: [TYPO3\Flow\Security\Authorization\Voter\Policy]
        #allowAccessIfAllVotersAbstain: TRUE