diff --git a/access_control.conf b/access_control.conf
new file mode 100644
index 0000000..fbfd1c3
--- /dev/null
+++ b/access_control.conf
@@ -0,0 +1,29 @@
+[request_definition]
+r = sub, obj, act
+
+[policy_definition]
+p = sub, obj, act
+
+[role_definition]
+g = _, _
+
+[policy_effect]
+e = some(where (p.eft == allow))
+
+[matchers]
+m = r.sub == p.sub && g(r.obj, p.obj) && r.act == p.act
+
+
+# access model definitions for cloud-registry
+
+# policy definitions
+# p, alice, maintainer, /ga4gh/registry/v1/1/services
+# p, bob, owner, /ga4gh/registry/v1/1/services
+# p, joe, admin, /ga4gh/registry/v1/service-info
+
+# role definitions
+# g, maintainer, PUT
+# g, owner, DELETE
+# g, owner, PUT
+# g, admin, PUT
+