acl:
 roles:
  guest:
    allowed-zones: public
    description: Non logged in users
  user:
    inherits: guest
    allowed-zones: user
    description: Logged in users
  admin:
    inherits: user
    description: Administrators
    allowed-zones: backend

 zones:
  public:   [ auth, api ]
  user:     [ user, callback ]
  backend:  backend/*