Rules for authorization

How to write rules