Generic actions

• admin - Implicitly allow all actions (special: cannot be denied)

• share - Share resource

• manage_resource_access - Manage resource grants