rules:
  # Marketing, Analytics and Accounting: allow GET session
  - path: /users/users/session/alw
    methods: [GET]
    groups:
      alw: [1, 2, 3, 4, 5]
      oa: ['*']

  # Allow marketing users to access /ws/ URLs
  - path: /users/ws/<*>
    methods: ['*']
    groups:
      alw: [2]

  # Admin: Allow all.
  - path: <*>
    methods: ['*']
    groups:
      alw: [4]
      oa: ['*']