+−⟲ user 1 user 2 group 1 securityGroup 1 can: create podscan: delete podscan: view pods can: view pods can: view pods can: view CSRcan: approve CSR