{
  "grant": ["enter"],
  "when": {"roles": "employee"}
}