rules:
  # Catalog: Only access one public url, so skip it.
  # Admin: Allow all.
  - path: <*>
    methods: ['*']
    groups:
      alw: [4]
      oa: ['*']