type: dictionary
additionalProperties: false
properties:
  'privilegeTargets':
    type: dictionary
    required: true
    additionalProperties:
      type: dictionary
      additionalProperties:
        type: dictionary
        additionalProperties: false
        properties:
          'label': {type: string}
          'matcher':
            type: string
            required: true
          'parameters':
            type: dictionary
            additionalProperties:
              type: dictionary
              additionalProperties: false
              properties:
                'className': {type: string, format: class-name}

  'roles':
    type: dictionary
    required: true
    additionalProperties:
      type: dictionary
      additionalProperties: false
      properties:
        'abstract': {type: boolean}
        'label': {type: string}
        'description': {type: string}
        'parentRoles':
          type: array
          items: {type: string}
        'privileges':
          type: array
          items:
            type: dictionary
            additionalProperties: false
            properties:
              'privilegeTarget': {type: string}
              'parameters': {type: dictionary}
              'permission': {type: string, enum: ['GRANT', 'DENY', 'ABSTAIN']}
