{
  "principals": {
    "principal1": {
      "principal_name": "sp-principal1",
      "principal_type": "User",
      "roles": [
        "Reader"
      ]
    },
    "principal2": {
      "principal_name": "sg-admins",
      "principal_type": "Group",
      "roles": [
        "Contributor"
      ]
    },
    "principal3": {
      "principal_name": "john.doe@example.com",
      "principal_type": "User",
      "roles": [
        "Owner"
      ],
      "restricted_roles": [
        "Owner",
        "User Access Administrator",
        "Role Based Access Control Administrator"
      ]
    }
  }
}