[rules-users] Complicated Grant Permissions Logic