example restriction for group to set of jobs

policy1.yaml

description: Admin, all access.
context:
  project: '.*' # all projects
for:
  resource:
    - allow: '*' # allow read/create all kinds
  adhoc:
    - allow: '*' # allow read/running/killing adhoc jobs
  job:
    - match:
        group: 'mygroup/.*'
      allow: '*' # allow all access to mygroup/ and no other jobs
    - match:
        group: 'other/.*'
      allow: 'read' # allow read access to other/ group
  node:
    - allow: '*' # allow read/run for all nodes
by:
  group: qa

---

description: Admin, all access.
context:
  application: 'rundeck'
for:
  resource:
    - allow: '*' # allow create of projects
  project:
    - allow: '*' # allow view/admin of all projects
by:
  group: qa