macro "allow" u:str "to" a:str "on" r:str : term => `(Rule.mk (fun req => req.user == $u && req.action == $a && req.resource == $r) .permit) macro "forbid" u:str "to" a:str "on" r:str : term => `(Rule.mk (fun req => req.user == $u && req.action == $a && req.resource == $r) .deny) -- `abstain` matches on *any* action for a (user, resource) pair and yields macro "abstain" u:str "on" r:str : term => `(Rule.mk (fun req => req.user == $u && req.resource == $r) .notApplicable)