# rbac for project owner, not allow for delete
roles:
  - project_owner
scope: project
policy:
  *:
    *:
      *: allow