rules:
  # Admin: Allow all.
  - path: <*>
    methods: ['*']
    profiles:
      LabelProfile: [administrator]
      OrchAdminProfile: ['*']