| name | readable_by |
|---|---|
| rule | EXISTS(S shared_with VPU, VPU permission IN ("read", "readwrite"), VPU granted_to_user O, O in_group G, G name 'users') OR EXISTS(S shared_with VPO, VPO permission IN ("read", "readwrite"), VPO granted_to_organisation ORG, PER has_organisation ORG, PER has_account O, O in_group G, G name 'users') OR EXISTS(S owned_by O) OR EXISTS(O in_group G, G name 'managers'), S is Version, O is CWUser |