{
	"luci-app-isp-split": {
		"description": "Grant access to ISP split status and control. WARNING: write = execute ANY isp-split subcommand as root (wire/apply/conf set/uninstall); grant only to fully trusted admins. read = conf + whole state tree (public IP/geo/STUN). wizard = one file write scope only (/etc/isp-split/state/wizard.json), no directory-wide write.",
		"read": {
			"ubus": {
				"file": [ "read", "stat" ]
			},
			"file": {
				"/etc/isp-split.conf": [ "read" ],
				"/etc/isp-split/*": [ "read" ],
				"/etc/isp-split/state/*": [ "read" ]
			}
		},
		"write": {
			"ubus": {
				"file": [ "exec", "write" ]
			},
			"file": {
				"/usr/sbin/isp-split": [ "exec" ],
				"/etc/isp-split/state/wizard.json": [ "write" ]
			}
		}
	}
}