security = """
New Web users get the Roles "User,Nosy"
New Email users get the Role "User"
Role "admin":
 User may access the rest interface (Rest Access)
 User may access the web interface (Web Access)
 User may access the xmlrpc interface (Xmlrpc Access)
 User may create everything (Create)
 User may edit everything (Edit)
 User may manipulate user Roles through the web (Web Roles)
 User may restore everything (Restore)
 User may retire everything (Retire)
 User may use the email interface (Email Access)
 User may view everything (View)
Role "anonymous":
 User may access the web interface (Web Access)
Role "cc-permission":
  (Restore for "cost_center_permission_group" only)
  (Retire for "cost_center_permission_group" only)
 User is allowed to create cost_center_permission_group (Create for "cost_center_permission_group" only)
 User is allowed to edit cost_center_permission_group (Edit for "cost_center_permission_group" only)
Role "contact":
 User is allowed to create contact (Create for "contact" only)
 User is allowed to edit contact (Edit for "contact" only)
Role "controlling":
 User is allowed Edit on (Edit for "daily_record": ('status', 'time_record') only)
 User is allowed Edit on (Edit for "sap_cc": ('group_lead', 'team_lead') only)
 User is allowed Edit on (Edit for "time_project": ('group_lead', 'team_lead') only)
 User is allowed Edit on (Edit for "time_wp": ('project',) only)
 User is allowed View on (View for "user": ('roles',) only)
 User is allowed View on (View for "user_dynamic": ('id', 'sap_cc', 'user', 'valid_from', 'valid_to') only)
 User is allowed to access contract_type (View for "contract_type" only)
 User is allowed to access daily_record (View for "daily_record" only)
 User is allowed to access daily_record_freeze (View for "daily_record_freeze" only)
 User is allowed to access leave_submission (View for "leave_submission" only)
 User is allowed to access overtime_correction (View for "overtime_correction" only)
 User is allowed to access query (View for "query" only)
 User is allowed to access time_project (View for "time_project" only)
 User is allowed to access time_record (View for "time_record" only)
 User is allowed to access time_report (View for "time_report" only)
 User is allowed to access time_wp (View for "time_wp" only)
 User is allowed to access vacation_correction (View for "vacation_correction" only)
 User is allowed to create cost_center (Create for "cost_center" only)
 User is allowed to create cost_center_group (Create for "cost_center_group" only)
 User is allowed to create cost_center_status (Create for "cost_center_status" only)
 User is allowed to create department (Create for "department" only)
 User is allowed to create organisation (Create for "organisation" only)
 User is allowed to create product_family (Create for "product_family" only)
 User is allowed to create public_holiday (Create for "public_holiday" only)
 User is allowed to create query (Create for "query" only)
 User is allowed to create reporting_group (Create for "reporting_group" only)
 User is allowed to create sap_cc (Create for "sap_cc" only)
 User is allowed to create time_activity (Create for "time_activity" only)
 User is allowed to create time_activity_perm (Create for "time_activity_perm" only)
 User is allowed to create time_record (Create for "time_record" only)
 User is allowed to create work_location (Create for "work_location" only)
 User is allowed to edit cost_center (Edit for "cost_center" only)
 User is allowed to edit cost_center_group (Edit for "cost_center_group" only)
 User is allowed to edit cost_center_status (Edit for "cost_center_status" only)
 User is allowed to edit department (Edit for "department" only)
 User is allowed to edit organisation (Edit for "organisation" only)
 User is allowed to edit product_family (Edit for "product_family" only)
 User is allowed to edit public_holiday (Edit for "public_holiday" only)
 User is allowed to edit query (Edit for "query" only)
 User is allowed to edit reporting_group (Edit for "reporting_group" only)
 User is allowed to edit sap_cc (Edit for "sap_cc" only)
 User is allowed to edit time_activity (Edit for "time_activity" only)
 User is allowed to edit time_activity_perm (Edit for "time_activity_perm" only)
 User is allowed to edit time_record (Edit for "time_record" only)
 User is allowed to edit work_location (Edit for "work_location" only)
Role "doc_admin":
 User is allowed Edit on (Edit for "department": ('doc_num',) only)
 User is allowed to create artefact (Create for "artefact" only)
 User is allowed to create doc (Create for "doc" only)
 User is allowed to create doc_category (Create for "doc_category" only)
 User is allowed to create doc_status (Create for "doc_status" only)
 User is allowed to create product_type (Create for "product_type" only)
 User is allowed to create reference (Create for "reference" only)
 User is allowed to edit artefact (Edit for "artefact" only)
 User is allowed to edit doc (Edit for "doc" only)
 User is allowed to edit doc_category (Edit for "doc_category" only)
 User is allowed to edit doc_status (Edit for "doc_status" only)
 User is allowed to edit product_type (Edit for "product_type" only)
 User is allowed to edit reference (Edit for "reference" only)
Role "dom-user-edit-facility":
 Users may view/edit user records for ad_domain for which they are in the domain_permission for the user (Edit for "user": ['room'] only)
 Users may view/edit user records for ad_domain for which they are in the domain_permission for the user (View for "user": ['room'] only)
Role "dom-user-edit-gtt":
  (Search for "user_dynamic" only)
 May only view/edit records with the correct domain (Edit for "user_dynamic" only)
 May only view/edit records with the correct domain (View for "user_dynamic" only)
 User is allowed to access contract_type (View for "contract_type" only)
 User is allowed to create user (Create for "user" only)
 User is allowed to create user_contact (Create for "user_contact" only)
 User is allowed to create user_dynamic (Create for "user_dynamic" only)
 User is allowed to edit user_contact (Edit for "user_contact" only)
 Users may view user_dynamic records for ad_domain for which they are in the domain_permission for the user (View for "user_dynamic" only)
 Users may view/edit user records for ad_domain for which they are in the domain_permission for the user (Edit for "user": ['contacts', 'csv_delimiter', 'department_temp', 'entry_date', 'firstname', 'hide_message_files', 'job_description', 'lastname', 'lunch_duration', 'lunch_start', 'nickname', 'pictures', 'position_text', 'room', 'sex', 'status', 'subst_active', 'substitute', 'supervisor', 'sync_foreign_key', 'timezone', 'tt_lines', 'username', 'vie_user'] only)
 Users may view/edit user records for ad_domain for which they are in the domain_permission for the user (View for "user": ['contacts', 'csv_delimiter', 'department_temp', 'entry_date', 'firstname', 'hide_message_files', 'job_description', 'lastname', 'lunch_duration', 'lunch_start', 'nickname', 'pictures', 'position_text', 'room', 'sex', 'status', 'subst_active', 'substitute', 'supervisor', 'sync_foreign_key', 'timezone', 'tt_lines', 'username', 'vie_user'] only)
Role "dom-user-edit-hr":
  (Search for "user_dynamic" only)
 May only view/edit records with the correct domain (Edit for "user_dynamic" only)
 May only view/edit records with the correct domain (View for "user_dynamic" only)
 User is allowed to access contract_type (View for "contract_type" only)
 User is allowed to create user_contact (Create for "user_contact" only)
 User is allowed to create user_dynamic (Create for "user_dynamic" only)
 User is allowed to edit user_contact (Edit for "user_contact" only)
 Users may view user_dynamic records for ad_domain for which they are in the domain_permission for the user (View for "user_dynamic" only)
 Users may view/edit user records for ad_domain for which they are in the domain_permission for the user (Edit for "user": ['clearance_by', 'contacts', 'csv_delimiter', 'entry_date', 'firstname', 'hide_message_files', 'job_description', 'lastname', 'lunch_duration', 'lunch_start', 'nickname', 'pictures', 'position_text', 'reduced_activity_list', 'roles', 'room', 'sex', 'status', 'subst_active', 'substitute', 'supervisor', 'timezone', 'tt_lines', 'vie_user'] only)
 Users may view/edit user records for ad_domain for which they are in the domain_permission for the user (View for "user": ['clearance_by', 'contacts', 'csv_delimiter', 'entry_date', 'firstname', 'hide_message_files', 'job_description', 'lastname', 'lunch_duration', 'lunch_start', 'nickname', 'pictures', 'position_text', 'reduced_activity_list', 'roles', 'room', 'sex', 'status', 'subst_active', 'substitute', 'supervisor', 'timezone', 'tt_lines', 'vie_user'] only)
Role "dom-user-edit-office":
 User is allowed to create user_contact (Create for "user_contact" only)
 User is allowed to edit user_contact (Edit for "user_contact" only)
 Users may view/edit user records for ad_domain for which they are in the domain_permission for the user (Edit for "user": ['contacts', 'position_text', 'room'] only)
 Users may view/edit user records for ad_domain for which they are in the domain_permission for the user (View for "user": ['contacts', 'position_text', 'room'] only)
Role "external":
  (Search for "ext_tracker_state": ('id', 'issue') only)
  (Search for "user": ('id', 'nickname', 'username') only)
 External users are allowed to access issue if they are on the list of allowed external users or there is a transitive permission via containers (Edit for "issue": ['activity', 'actor', 'area', 'category', 'closed', 'composed_of', 'creation', 'creator', 'cur_est_begin', 'cur_est_end', 'deadline', 'depends', 'doc_issue_status', 'earliest_start', 'effective_prio', 'effort_hours', 'external_users', 'files', 'files_affected', 'fixed_in', 'id', 'keywords', 'kind', 'maturity_index', 'messages', 'needs', 'nosy', 'numeric_effort', 'part_of', 'planned_begin', 'planned_end', 'priority', 'release', 'responsible', 'safety_level', 'severity', 'status', 'superseder', 'test_level', 'title'] only)
 External users are allowed to access issue if they are on the list of allowed external users or there is a transitive permission via containers (View for "issue": ['activity', 'actor', 'area', 'category', 'closed', 'composed_of', 'creation', 'creator', 'cur_est_begin', 'cur_est_end', 'deadline', 'depends', 'doc_issue_status', 'earliest_start', 'effective_prio', 'effort_hours', 'external_users', 'files', 'files_affected', 'fixed_in', 'id', 'keywords', 'kind', 'maturity_index', 'messages', 'needs', 'nosy', 'numeric_effort', 'part_of', 'planned_begin', 'planned_end', 'priority', 'release', 'responsible', 'safety_level', 'severity', 'status', 'superseder', 'test_level', 'title'] only)
 User is allowed View on (View for "category": ('id', 'name') only)
 User is allowed View on (View for "user": ('nickname', 'status', 'username') only)
 User is allowed View on (View for "user_status": ('name',) only)
 User is allowed View on file if file is linked from an item with View permission (View for "file" only)
 User is allowed View on msg if msg is linked from an item with View permission (View for "msg" only)
 User is allowed to access area (View for "area" only)
 User is allowed to access doc_issue_status (View for "doc_issue_status" only)
 User is allowed to access ext_tracker (View for "ext_tracker" only)
 User is allowed to access ext_tracker_state (View for "ext_tracker_state" only)
 User is allowed to access ext_tracker_type (View for "ext_tracker_type" only)
 User is allowed to access keyword (View for "keyword" only)
 User is allowed to access kind (View for "kind" only)
 User is allowed to access msg_keyword (View for "msg_keyword" only)
 User is allowed to access safety_level (View for "safety_level" only)
 User is allowed to access severity (View for "severity" only)
 User is allowed to access status (View for "status" only)
 User is allowed to access status_transition (View for "status_transition" only)
 User is allowed to access test_level (View for "test_level" only)
 User is allowed to create file (Create for "file" only)
 User is allowed to create issue (Create for "issue" only)
 User is allowed to create msg (Create for "msg" only)
 User is allowed to create query (Create for "query" only)
 User is allowed to edit their queries (Edit for "query" only)
 User is allowed to retire their queries (Retire for "query" only)
 User is allowed to search for their own files (Search for "file" only)
 User is allowed to search for their own messages (Search for "msg" only)
 User is allowed to search for their queries (Search for "query" only)
 User is allowed to search issue (Search for "issue" only)
 User is allowed to view their own files (View for "file" only)
 User may access the web interface (Web Access)
 User may use the email interface (Email Access)
 Users are allowed to edit some of their details (Edit for "user": ('csv_delimiter', 'hide_message_files', 'password', 'timezone') only)
 Users are allowed to view some of their details (View for "user": ('activity', 'actor', 'creation', 'creator', 'firstname', 'lastname', 'realname', 'username') only)
 Users are allowed to view their own and public queries for classes where they have search permission (View for "query" only)
Role "facility":
  (Restore for "room" only)
  (Retire for "room" only)
 User is allowed to create room (Create for "room" only)
 User is allowed to edit room (Edit for "room" only)
Role "functional-role":
  (Restore for "user_functional_role" only)
  (Retire for "user_functional_role" only)
 User is allowed Edit on (Edit for "user": ('business_responsible', 'scale_seniority') only)
 User is allowed View on (View for "user": ('business_responsible', 'planning_role', 'scale_seniority') only)
 User is allowed to access user_functional_role (View for "user_functional_role" only)
 User is allowed to create user_functional_role (Create for "user_functional_role" only)
 User is allowed to edit user_functional_role (Edit for "user_functional_role" only)
Role "hr":
  (Edit for "overtime_period": ('name', 'order') only)
  (Restore for "room" only)
  (Retire for "room" only)
 User is allowed Edit on (Edit for "daily_record": ('required_overtime', 'weekend_allowed') only)
 User is allowed Edit on (Edit for "daily_record": ('status', 'time_record') only)
 User is allowed Edit on (Edit for "time_project": ('approval_hr', 'approval_required', 'is_extern', 'is_public_holiday', 'is_special_leave', 'is_vacation', 'no_overtime', 'no_overtime_day', 'only_hours', 'overtime_reduction') only)
 User is allowed View on (View for "user": ('contacts',) only)
 User is allowed to access auto_wp (View for "auto_wp" only)
 User is allowed to access contract_type (View for "contract_type" only)
 User is allowed to access daily_record (View for "daily_record" only)
 User is allowed to access daily_record_freeze (View for "daily_record_freeze" only)
 User is allowed to access leave_submission (View for "leave_submission" only)
 User is allowed to access overtime_correction (View for "overtime_correction" only)
 User is allowed to access time_record (View for "time_record" only)
 User is allowed to access user_contact (View for "user_contact" only)
 User is allowed to access user_dynamic (View for "user_dynamic" only)
 User is allowed to access vacation_correction (View for "vacation_correction" only)
 User is allowed to create auto_wp (Create for "auto_wp" only)
 User is allowed to create daily_record_freeze (Create for "daily_record_freeze" only)
 User is allowed to create location (Create for "location" only)
 User is allowed to create org_location (Create for "org_location" only)
 User is allowed to create organisation (Create for "organisation" only)
 User is allowed to create overtime_correction (Create for "overtime_correction" only)
 User is allowed to create overtime_period (Create for "overtime_period" only)
 User is allowed to create product_family (Create for "product_family" only)
 User is allowed to create public_holiday (Create for "public_holiday" only)
 User is allowed to create reporting_group (Create for "reporting_group" only)
 User is allowed to create room (Create for "room" only)
 User is allowed to create sap_cc (Create for "sap_cc" only)
 User is allowed to create time_record (Create for "time_record" only)
 User is allowed to create uc_type (Create for "uc_type" only)
 User is allowed to create user (Create for "user" only)
 User is allowed to create user_dynamic (Create for "user_dynamic" only)
 User is allowed to edit auto_wp (Edit for "auto_wp" only)
 User is allowed to edit dynamic user data if not frozen in validity span of dynamic user record (Edit for "user_dynamic" only)
 User is allowed to edit freeze record if not frozen at the given date (Edit for "daily_record_freeze": ('frozen',) only)
 User is allowed to edit location (Edit for "location" only)
 User is allowed to edit org_location (Edit for "org_location" only)
 User is allowed to edit organisation (Edit for "organisation" only)
 User is allowed to edit overtime correction if the overtime correction is not frozen (Edit for "overtime_correction" only)
 User is allowed to edit product_family (Edit for "product_family" only)
 User is allowed to edit public_holiday (Edit for "public_holiday" only)
 User is allowed to edit reporting_group (Edit for "reporting_group" only)
 User is allowed to edit room (Edit for "room" only)
 User is allowed to edit sap_cc (Edit for "sap_cc" only)
 User is allowed to edit time_record (Edit for "time_record" only)
 User is allowed to edit uc_type (Edit for "uc_type" only)
 User may manipulate user Roles through the web (Web Roles)
Role "hr-leave-approval":
 User is allowed Edit on (Edit for "leave_submission": ('status',) only)
 User is allowed to access contract_type (View for "contract_type" only)
 User is allowed to access leave_submission (View for "leave_submission" only)
 User is allowed to access vacation_correction (View for "vacation_correction" only)
Role "hr-org-location":
  (Search for "daily_record_freeze" only)
  (Search for "overtime_correction" only)
  (Search for "time_activity_perm" only)
  (Search for "time_record" only)
  (Search for "user_dynamic" only)
 User is allowed to view dynamic user data if he/she is in group HR-Org-Location and in the same Org-Location as the given user (View for "user_dynamic" only)
 User is allowed to view freeze information if he/she is in group HR-Org-Location and in the same Org-Location as the given user (View for "daily_record_freeze" only)
 User is allowed to view overtime information if he/she is in group HR-Org-Location and in the same Org-Location as the given user (View for "overtime_correction" only)
 User is allowed to view time record data if he/she is in group HR-Org-Location and in the same Org-Location as the given user (View for "time_record" only)
Role "hr-vacation":
 User is allowed to access contract_type (View for "contract_type" only)
 User is allowed to access leave_submission (View for "leave_submission" only)
 User is allowed to access vacation_correction (View for "vacation_correction" only)
 User is allowed to create contract_type (Create for "contract_type" only)
 User is allowed to create leave_submission (Create for "leave_submission" only)
 User is allowed to create vacation_correction (Create for "vacation_correction" only)
 User is allowed to edit contract_type (Edit for "contract_type" only)
 User is allowed to edit leave_submission (Edit for "leave_submission" only)
 User is allowed to edit vacation_correction (Edit for "vacation_correction" only)
Role "issue_admin":
 User is allowed Edit on msg if msg is linked from an item with Edit permission (Edit for "msg" only)
 User is allowed to access issue (View for "issue" only)
 User is allowed to create area (Create for "area" only)
 User is allowed to create category (Create for "category" only)
 User is allowed to create doc_issue_status (Create for "doc_issue_status" only)
 User is allowed to create ext_tracker (Create for "ext_tracker" only)
 User is allowed to create issue (Create for "issue" only)
 User is allowed to create keyword (Create for "keyword" only)
 User is allowed to create kind (Create for "kind" only)
 User is allowed to create msg_keyword (Create for "msg_keyword" only)
 User is allowed to create safety_level (Create for "safety_level" only)
 User is allowed to create severity (Create for "severity" only)
 User is allowed to create status (Create for "status" only)
 User is allowed to create status_transition (Create for "status_transition" only)
 User is allowed to create test_level (Create for "test_level" only)
 User is allowed to edit area (Edit for "area" only)
 User is allowed to edit category (Edit for "category" only)
 User is allowed to edit doc_issue_status (Edit for "doc_issue_status" only)
 User is allowed to edit ext_tracker (Edit for "ext_tracker" only)
 User is allowed to edit issue (Edit for "issue" only)
 User is allowed to edit keyword (Edit for "keyword" only)
 User is allowed to edit kind (Edit for "kind" only)
 User is allowed to edit msg_keyword (Edit for "msg_keyword" only)
 User is allowed to edit safety_level (Edit for "safety_level" only)
 User is allowed to edit severity (Edit for "severity" only)
 User is allowed to edit status (Edit for "status" only)
 User is allowed to edit status_transition (Edit for "status_transition" only)
 User is allowed to edit test_level (Edit for "test_level" only)
Role "it":
 Create (Create for "user_contact" only)
 User is allowed Edit on (Edit for "file": ('name', 'type') only)
 User is allowed Edit on (Edit for "location": ('domain_part',) only)
 User is allowed Edit on (Edit for "organisation": ('domain_part',) only)
 User is allowed Edit on (Edit for "user": ('ad_domain', 'nickname', 'password', 'pictures', 'roles', 'timetracking_by', 'timezone', 'username') only)
 User is allowed Edit on (Edit for "user": ('address', 'alternate_addresses', 'nickname', 'password', 'timezone', 'username') only)
 User is allowed Edit on file if file is linked from an item with Edit permission (Edit for "file" only)
 User is allowed Edit on msg if msg is linked from an item with Edit permission (Edit for "msg" only)
 User is allowed View on file if file is linked from an item with View permission (View for "file" only)
 User is allowed to access domain_permission (View for "domain_permission" only)
 User is allowed to access it_int_prio (View for "it_int_prio" only)
 User is allowed to access it_issue (View for "it_issue" only)
 User is allowed to access it_project (View for "it_project" only)
 User is allowed to create domain_permission (Create for "domain_permission" only)
 User is allowed to create it_category (Create for "it_category" only)
 User is allowed to create it_int_prio (Create for "it_int_prio" only)
 User is allowed to create it_issue (Create for "it_issue" only)
 User is allowed to create it_project (Create for "it_project" only)
 User is allowed to create it_request_type (Create for "it_request_type" only)
 User is allowed to create mailgroup (Create for "mailgroup" only)
 User is allowed to edit domain_permission (Edit for "domain_permission" only)
 User is allowed to edit it_category (Edit for "it_category" only)
 User is allowed to edit it_int_prio (Edit for "it_int_prio" only)
 User is allowed to edit it_issue (Edit for "it_issue" only)
 User is allowed to edit it_project (Edit for "it_project" only)
 User is allowed to edit it_request_type (Edit for "it_request_type" only)
 User is allowed to edit mailgroup (Edit for "mailgroup" only)
 User may manipulate user Roles through the web (Web Roles)
Role "itview":
 User is allowed to access it_int_prio (View for "it_int_prio" only)
 User is allowed to access it_issue (View for "it_issue" only)
 User is allowed to access it_project (View for "it_project" only)
Role "msgedit":
  (Search for "msg": ('date', 'id') only)
 User is allowed Edit on (Edit for "msg": ('author', 'date', 'id', 'keywords', 'subject', 'summary') only)
 User is allowed to access ext_msg (View for "ext_msg" only)
 User is allowed to access ext_tracker_state (View for "ext_tracker_state" only)
 User is allowed to access ext_tracker_type (View for "ext_tracker_type" only)
Role "msgsync":
  (Search for "msg": ('date', 'id') only)
 User is allowed Edit on (Edit for "msg": ('author', 'date', 'id', 'keywords', 'subject', 'summary') only)
 User is allowed to access ext_msg (View for "ext_msg" only)
 User is allowed to access ext_tracker_state (View for "ext_tracker_state" only)
 User is allowed to access ext_tracker_type (View for "ext_tracker_type" only)
 User is allowed to create ext_msg (Create for "ext_msg" only)
 User is allowed to create ext_tracker_state (Create for "ext_tracker_state" only)
 User is allowed to edit ext_msg (Edit for "ext_msg" only)
 User is allowed to edit ext_tracker_state (Edit for "ext_tracker_state" only)
Role "nosy":
 User may get nosy messages for doc (Nosy for "doc" only)
 User may get nosy messages for issue (Nosy for "issue" only)
 User may get nosy messages for it_issue (Nosy for "it_issue" only)
 User may get nosy messages for it_project (Nosy for "it_project" only)
 User may get nosy messages for support (Nosy for "support" only)
Role "office":
  (Restore for "room" only)
  (Retire for "room" only)
 User is allowed View on (View for "user": ('contacts',) only)
 User is allowed to access user_contact (View for "user_contact" only)
 User is allowed to create absence (Create for "absence" only)
 User is allowed to create absence_type (Create for "absence_type" only)
 User is allowed to create room (Create for "room" only)
 User is allowed to create uc_type (Create for "uc_type" only)
 User is allowed to edit absence (Edit for "absence" only)
 User is allowed to edit absence_type (Edit for "absence_type" only)
 User is allowed to edit room (Edit for "room" only)
 User is allowed to edit uc_type (Edit for "uc_type" only)
Role "organisation":
 User is allowed to access location (View for "location" only)
 User is allowed to access org_location (View for "org_location" only)
 User is allowed to access organisation (View for "organisation" only)
 User is allowed to create location (Create for "location" only)
 User is allowed to create org_location (Create for "org_location" only)
 User is allowed to create organisation (Create for "organisation" only)
 User is allowed to edit location (Edit for "location" only)
 User is allowed to edit org_location (Edit for "org_location" only)
 User is allowed to edit organisation (Edit for "organisation" only)
Role "pgp":
Role "procurement":
  (View for "sap_cc" only)
  (View for "time_project" only)
 User is allowed Edit on (Edit for "sap_cc": ('group_lead', 'purchasing_agents', 'team_lead') only)
 User is allowed Edit on (Edit for "time_project": ('group_lead', 'purchasing_agents', 'team_lead') only)
Role "project":
 User is allowed Edit on (Edit for "time_project": ('cost_center', 'department', 'deputy', 'description', 'name', 'nosy', 'organisation', 'responsible', 'status') only)
 User is allowed Edit on (Edit for "time_project": ('infosec_req', 'is_extern', 'max_hours', 'op_project', 'planned_effort', 'product_family', 'project_type', 'reporting_group', 'work_location') only)
 User is allowed to access time_project (View for "time_project" only)
 User is allowed to access time_report (View for "time_report" only)
 User is allowed to access time_wp (View for "time_wp" only)
 User is allowed to create time_project (Create for "time_project" only)
 User is allowed to create time_project_status (Create for "time_project_status" only)
 User is allowed to create time_wp (Create for "time_wp" only)
 User is allowed to create time_wp_group (Create for "time_wp_group" only)
 User is allowed to edit time_project_status (Edit for "time_project_status" only)
 User is allowed to edit time_wp (Edit for "time_wp" only)
 User is allowed to edit time_wp_group (Edit for "time_wp_group" only)
Role "project_view":
 User is allowed to access time_project (View for "time_project" only)
 User is allowed to access time_report (View for "time_report" only)
 User is allowed to access time_wp (View for "time_wp" only)
Role "sec-incident-nosy":
 User is allowed to access it_int_prio (View for "it_int_prio" only)
 User is allowed to access it_issue (View for "it_issue" only)
 User is allowed to access it_project (View for "it_project" only)
Role "sec-incident-responsible":
 User is allowed to access it_int_prio (View for "it_int_prio" only)
 User is allowed to access it_issue (View for "it_issue" only)
 User is allowed to access it_project (View for "it_project" only)
Role "staff-report":
Role "sub-login":
Role "summary_view":
Role "supportadmin":
 User is allowed to access analysis_result (View for "analysis_result" only)
 User is allowed to access contact (View for "contact" only)
 User is allowed to access customer (View for "customer" only)
 User is allowed to access customer_agreement (View for "customer_agreement" only)
 User is allowed to access mailgroup (View for "mailgroup" only)
 User is allowed to access return_type (View for "return_type" only)
 User is allowed to access sup_classification (View for "sup_classification" only)
 User is allowed to access support (View for "support" only)
 User is allowed to create analysis_result (Create for "analysis_result" only)
 User is allowed to create contact (Create for "contact" only)
 User is allowed to create customer (Create for "customer" only)
 User is allowed to create customer_agreement (Create for "customer_agreement" only)
 User is allowed to create mailgroup (Create for "mailgroup" only)
 User is allowed to create return_type (Create for "return_type" only)
 User is allowed to create sup_classification (Create for "sup_classification" only)
 User is allowed to create support (Create for "support" only)
 User is allowed to edit analysis_result (Edit for "analysis_result" only)
 User is allowed to edit contact (Edit for "contact" only)
 User is allowed to edit customer (Edit for "customer" only)
 User is allowed to edit customer_agreement (Edit for "customer_agreement" only)
 User is allowed to edit mailgroup (Edit for "mailgroup" only)
 User is allowed to edit return_type (Edit for "return_type" only)
 User is allowed to edit sup_classification (Edit for "sup_classification" only)
 User is allowed to edit support (Edit for "support" only)
Role "time-report":
 User is allowed to access time_report (View for "time_report" only)
 User is allowed to create time_report (Create for "time_report" only)
 User is allowed to edit time_report (Edit for "time_report" only)
 User may edit own file (file created by user) (Edit for "file" only)
Role "user":
  (Search for "time_project": ('activity', 'actor', 'creation', 'creator', 'deputy', 'description', 'id', 'is_extern', 'is_public_holiday', 'is_special_leave', 'is_vacation', 'name', 'nosy', 'only_hours', 'op_project', 'overtime_reduction', 'responsible', 'status', 'work_location', 'wps') only)
  (Search for "time_wp": ('activity', 'actor', 'auto_wp', 'bookers', 'cost_center', 'creation', 'creator', 'description', 'durations_allowed', 'epic_key', 'has_expiration_date', 'id', 'is_extern', 'is_public', 'name', 'project', 'responsible', 'time_end', 'time_start', 'time_wp_summary_no', 'travel', 'wp_no') only)
  (View for "time_project": ('activity', 'actor', 'creation', 'creator', 'deputy', 'description', 'id', 'is_extern', 'is_public_holiday', 'is_special_leave', 'is_vacation', 'name', 'nosy', 'only_hours', 'op_project', 'overtime_reduction', 'responsible', 'status', 'work_location', 'wps') only)
 Search (Search for "user_contact" only)
 User is allowed Edit on (Edit for "msg": ('keywords',) only)
 User is allowed Edit on file if file is linked from an item with Edit permission (Edit for "file" only)
 User is allowed Edit on issue if issue is non-confidential or user is on nosy list (Edit for "issue" only)
 User is allowed Edit on it_issue if it_issue is non-confidential or user is on nosy list (Edit for "it_issue": ('messages', 'files', 'nosy') only)
 User is allowed Edit on it_project if it_project is non-confidential or user is on nosy list (Edit for "it_project": ('messages', 'files', 'nosy') only)
 User is allowed Edit on support if support is non-confidential or user is on nosy list (Edit for "support": ('analysis_end', 'analysis_result', 'analysis_start', 'bcc', 'business_unit', 'category', 'cc', 'cc_emails', 'classification', 'closed', 'confidential', 'customer', 'emails', 'execution', 'external_ref', 'files', 'goods_received', 'goods_sent', 'lot', 'messages', 'nosy', 'number_effected', 'numeric_effort', 'prio', 'prodcat', 'product', 'related_issues', 'related_support', 'release', 'responsible', 'return_type', 'sap_ref', 'send_to_customer', 'serial_number', 'set_first_reply', 'status', 'superseder', 'title', 'type', 'warranty') only)
 User is allowed View on (View for "user": ('activity', 'actor', 'ad_domain', 'address', 'alternate_addresses', 'business_responsible', 'clearance_by', 'creation', 'creator', 'firstname', 'id', 'job_description', 'lastname', 'lunch_duration', 'lunch_start', 'nickname', 'pictures', 'position_text', 'queries', 'realname', 'room', 'sex', 'status', 'subst_active', 'substitute', 'supervisor', 'timezone', 'title', 'tt_lines', 'username') only)
 User is allowed View on (View for "user": ('activity', 'actor', 'address', 'alternate_addresses', 'creation', 'creator', 'id', 'queries', 'realname', 'status', 'timezone', 'username') only)
 User is allowed View on (View for "user": ('business_responsible', 'department_temp', 'timetracking_by', 'vie_user', 'vie_user_bl_override', 'vie_user_ml') only)
 User is allowed View on (View for "user": ('contacts',) only)
 User is allowed View on (View for "user_dynamic": ('department', 'org_location') only)
 User is allowed View on file if file is linked from an item with View permission (View for "file" only)
 User is allowed View on issue if issue is non-confidential or user is on nosy list (View for "issue" only)
 User is allowed View on it_issue if it_issue is non-confidential or user is on nosy list (View for "it_issue" only)
 User is allowed View on it_project if it_project is non-confidential or user is on nosy list (View for "it_project" only)
 User is allowed View on msg if msg is linked from an item with View permission (View for "msg" only)
 User is allowed View on support if support is non-confidential or user is on nosy list (View for "support" only)
 User is allowed to access absence (View for "absence" only)
 User is allowed to access absence_type (View for "absence_type" only)
 User is allowed to access analysis_result (View for "analysis_result" only)
 User is allowed to access area (View for "area" only)
 User is allowed to access artefact (View for "artefact" only)
 User is allowed to access business_unit (View for "business_unit" only)
 User is allowed to access category (View for "category" only)
 User is allowed to access contact (View for "contact" only)
 User is allowed to access contact_type (View for "contact_type" only)
 User is allowed to access cost_center (View for "cost_center" only)
 User is allowed to access cost_center_group (View for "cost_center_group" only)
 User is allowed to access cost_center_permission_group (View for "cost_center_permission_group" only)
 User is allowed to access cost_center_status (View for "cost_center_status" only)
 User is allowed to access customer (View for "customer" only)
 User is allowed to access customer_agreement (View for "customer_agreement" only)
 User is allowed to access daily record if he is owner or supervisor or timetracking-by user (Edit for "daily_record": ('status', 'time_record') only)
 User is allowed to access daily record if he is owner or supervisor or timetracking-by user (View for "daily_record" only)
 User is allowed to access daily_record_status (View for "daily_record_status" only)
 User is allowed to access department (View for "department" only)
 User is allowed to access doc (View for "doc" only)
 User is allowed to access doc_category (View for "doc_category" only)
 User is allowed to access doc_issue_status (View for "doc_issue_status" only)
 User is allowed to access doc_status (View for "doc_status" only)
 User is allowed to access ext_tracker (View for "ext_tracker" only)
 User is allowed to access ext_tracker_state (View for "ext_tracker_state" only)
 User is allowed to access ext_tracker_type (View for "ext_tracker_type" only)
 User is allowed to access functional_role (View for "functional_role" only)
 User is allowed to access it_category (View for "it_category" only)
 User is allowed to access it_issue_status (View for "it_issue_status" only)
 User is allowed to access it_prio (View for "it_prio" only)
 User is allowed to access it_project_status (View for "it_project_status" only)
 User is allowed to access it_request_type (View for "it_request_type" only)
 User is allowed to access keyword (View for "keyword" only)
 User is allowed to access kind (View for "kind" only)
 User is allowed to access leave_status (View for "leave_status" only)
 User is allowed to access location (View for "location" only)
 User is allowed to access mailgroup (View for "mailgroup" only)
 User is allowed to access msg_keyword (View for "msg_keyword" only)
 User is allowed to access org_group (View for "org_group" only)
 User is allowed to access org_location (View for "org_location" only)
 User is allowed to access organisation (View for "organisation" only)
 User is allowed to access overtime_period (View for "overtime_period" only)
 User is allowed to access prodcat (View for "prodcat" only)
 User is allowed to access product (View for "product" only)
 User is allowed to access product_family (View for "product_family" only)
 User is allowed to access product_type (View for "product_type" only)
 User is allowed to access project_type (View for "project_type" only)
 User is allowed to access public_holiday (View for "public_holiday" only)
 User is allowed to access reference (View for "reference" only)
 User is allowed to access reporting_group (View for "reporting_group" only)
 User is allowed to access return_type (View for "return_type" only)
 User is allowed to access room (View for "room" only)
 User is allowed to access safety_level (View for "safety_level" only)
 User is allowed to access sap_cc (View for "sap_cc" only)
 User is allowed to access severity (View for "severity" only)
 User is allowed to access sex (View for "sex" only)
 User is allowed to access status (View for "status" only)
 User is allowed to access status_transition (View for "status_transition" only)
 User is allowed to access summary_report (View for "summary_report" only)
 User is allowed to access summary_type (View for "summary_type" only)
 User is allowed to access sup_classification (View for "sup_classification" only)
 User is allowed to access sup_execution (View for "sup_execution" only)
 User is allowed to access sup_prio (View for "sup_prio" only)
 User is allowed to access sup_status (View for "sup_status" only)
 User is allowed to access sup_type (View for "sup_type" only)
 User is allowed to access sup_warranty (View for "sup_warranty" only)
 User is allowed to access test_level (View for "test_level" only)
 User is allowed to access time_activity (View for "time_activity" only)
 User is allowed to access time_activity_perm (View for "time_activity_perm" only)
 User is allowed to access time_project_status (View for "time_project_status" only)
 User is allowed to access time_wp_group (View for "time_wp_group" only)
 User is allowed to access time_wp_summary_no (View for "time_wp_summary_no" only)
 User is allowed to access timesheet (View for "timesheet" only)
 User is allowed to access uc_type (View for "uc_type" only)
 User is allowed to access user_status (View for "user_status" only)
 User is allowed to access vac_aliq (View for "vac_aliq" only)
 User is allowed to access vacation_report (View for "vacation_report" only)
 User is allowed to access work_location (View for "work_location" only)
 User is allowed to create daily_record (Create for "daily_record" only)
 User is allowed to create doc (Create for "doc" only)
 User is allowed to create ext_tracker_state (Create for "ext_tracker_state" only)
 User is allowed to create file (Create for "file" only)
 User is allowed to create issue (Create for "issue" only)
 User is allowed to create it_issue (Create for "it_issue" only)
 User is allowed to create leave_submission (Create for "leave_submission" only)
 User is allowed to create msg (Create for "msg" only)
 User is allowed to create queries (Create for "query" only)
 User is allowed to create support (Create for "support" only)
 User is allowed to create time_record (Create for "time_record" only)
 User is allowed to create time_wp (Create for "time_wp" only)
 User is allowed to edit (some of) their own user details (Edit for "user": ('csv_delimiter', 'hide_message_files', 'lunch_duration', 'lunch_start', 'password', 'queries', 'realname', 'room', 'subst_active', 'substitute', 'timezone', 'tt_lines') only)
 User is allowed to edit category if he is responsible for it (Edit for "category": ('nosy', 'default_part_of') only)
 User is allowed to edit doc (Edit for "doc" only)
 User is allowed to edit ext_tracker_state (Edit for "ext_tracker_state" only)
 User is allowed to edit if he's the owner of the contact (Edit for "user_contact": ('visible',) only)
 User is allowed to edit several fields if he is Responsible for an it_issue (Edit for "it_issue": ('responsible',) only)
 User is allowed to edit several fields if he is Stakeholder/Responsible for an it_issue (Edit for "it_issue": ('deadline', 'status', 'title') only)
 User is allowed to edit their queries (Edit for "query" only)
 User is allowed to edit time category if the status is "Open" and he is responsible for the time category (Edit for "time_project": ('deputy', 'planned_effort', 'nosy') only)
 User is allowed to edit workpackage if he is time category owner or deputy (Edit for "time_wp": ('cost_center', 'is_public', 'name', 'responsible', 'time_wp_summary_no', 'wp_no') only)
 User is allowed to retire their queries (Retire for "query" only)
 User is allowed to search daily_record (Search for "daily_record" only)
 User is allowed to search for their own files (Search for "file" only)
 User is allowed to search for their own messages (Search for "msg" only)
 User is allowed to search for their queries (Search for "query" only)
 User is allowed to search issue (Search for "issue" only)
 User is allowed to search it_issue (Search for "it_issue" only)
 User is allowed to search it_project (Search for "it_project" only)
 User is allowed to search leave_submission (Search for "leave_submission" only)
 User is allowed to search support (Search for "support" only)
 User is allowed to search time_record (Search for "time_record" only)
 User is allowed to search time_wp (Search for "time_wp": ('activity', 'actor', 'auto_wp', 'cost_center', 'creation', 'creator', 'description', 'durations_allowed', 'epic_key', 'has_expiration_date', 'is_extern', 'is_public', 'id', 'name', 'project', 'responsible', 'time_end', 'time_start', 'time_wp_summary_no', 'travel', 'wp_no') only)
 User is allowed to search user_status (Search for "user": ('status',) only)
 User is allowed to see time record if he is allowed to see all details on work package or User may view a daily_record (and time_records that are attached to that daily_record) if the user owns the daily_record or has role 'HR' or 'Controlling', or the user is supervisor or substitute supervisor of the owner of the daily record (the supervisor relationship is transitive) or the user is the department manager of the owner of the daily record. If user has role HR-Org-Location and is in the same Org-Location as the record, it may also be seen (View for "time_record" only)
 User is allowed to view (some of) their own user details (View for "user": ('entry_date', 'planning_role') only)
 User is allowed to view contact if he's the owner of the contact or the contact is marked visible (View for "user_contact" only)
 User is allowed to view leave submission if he is the supervisor or the person to whom approvals are delegated (Edit for "leave_submission": ('status',) only)
 User is allowed to view leave submission if he is the supervisor or the person to whom approvals are delegated (View for "leave_submission" only)
 User is allowed to view selected fields in work package if booking is allowed for this user (also applies to timetracking by, supervisor and approval delegated) (View for "time_wp": ('activity', 'actor', 'cost_center', 'creation', 'creator', 'description', 'durations_allowed', 'epic_key', 'has_expiration_date', 'id', 'is_extern', 'is_public', 'name', 'project', 'responsible', 'time_end', 'time_start', 'time_wp_summary_no', 'travel', 'wp_no') only)
 User is allowed to view their own files (View for "file" only)
 User is allowed to view their own messages (View for "msg" only)
 User is allowed to view their own overtime information (View for "overtime_correction" only)
 User is allowed to view time record if he is the supervisor or the person to whom approvals are delegated (View for "time_record" only)
 User is allowed to view work package and time category names if he/she has role HR or HR-Org-Location (View for "time_project": ('name',) only)
 User is allowed to view work package and time category names if he/she has role HR or HR-Org-Location (View for "time_wp": ('name', 'project') only)
 User is allowed to view/edit workpackage if he is owner or project responsible/deputy (Edit for "time_wp": ('bookers', 'description', 'epic_key', 'planned_effort', 'time_end', 'time_start', 'time_wp_summary_no') only)
 User may access the rest interface (Rest Access)
 User may access the web interface (Web Access)
 User may access the xmlrpc interface (Xmlrpc Access)
 User may edit own leave submissions (Edit for "leave_submission": ('comment', 'comment_cancel', 'first_day', 'last_day', 'status', 'time_wp', 'user') only)
 User may edit own leave submissions (View for "leave_submission": ('comment', 'comment_cancel', 'first_day', 'last_day', 'status', 'time_wp', 'user') only)
 User may see time report if reponsible or deputy of time project or on nosy list of time project (View for "time_report" only)
 User may use the email interface (Email Access)
 User may view a daily_record (and time_records that are attached to that daily_record) if the user owns the daily_record or has role 'HR' or 'Controlling', or the user is supervisor or substitute supervisor of the owner of the daily record (the supervisor relationship is transitive) or the user is the department manager of the owner of the daily record. If user has role HR-Org-Location and is in the same Org-Location as the record, it may also be seen (View for "daily_record" only)
 User may view their own user functional role (View for "user_functional_role" only)
 User may view time category if user is owner or deputy of time category or on nosy list of time category or if user is department manager of time category (View for "time_project" only)
 User may view work package if responsible for it, if user is owner or deputy of time category or on nosy list of time category or if user is department manager of time category (View for "time_wp" only)
 User or Timetracking by user may edit time_records owned by user (Edit for "time_record" only)
 User or Timetracking by user may edit time_records owned by user (Restore for "time_record" only)
 User or Timetracking by user may edit time_records owned by user (Retire for "time_record" only)
 User or Timetracking by user may edit time_records owned by user (View for "time_record" only)
 Users are allowed to view their own and public queries for classes where they have search permission (View for "query" only)
 Users may see daily record if they may see one of the time_records for that day (View for "daily_record" only)
Role "user_view":
 User is allowed to access user (View for "user" only)
Role "vacation-report":
""".strip ()

[]