service.policy

# /etc/mcollective/policies/service.policy

# The file is active, because if I change this to allow, then actions are allowed
policy default deny

# but this line doesn't work. These are hard tabs.
allow *  restart *




#######
[root@classroom ~]# service pe-mcollective restart
Shutting down pe-mcollective:                              [  OK  ]
Starting pe-mcollective:                                   [  OK  ]
[root@classroom ~]# sudo -i -u peadmin mco service ntp restart
Do you really want to operate on services unfiltered? (y/n): y

 * [ ============================================================> ] 1 / 1

   classroom.puppetlabs.vm: You are not authorized to call this agent or action.

Summary of Service Status:

   unknown = 1


Finished processing 1 / 1 hosts in 110.99 ms


#########

Solved by reading code. The "optional" fifth column is not optional.