...
There will be a separate permission for traversal and resources. Let's call them org.onap.aai.resources.access and org.onap.aai.traversal.access. For now we will not distinguish between different objects we could affect, so the instance will always be "*" meaning everything. Actions will be mapped to HTTP verbs - GET, PUT, POST, DELETE, PATCH.
For a seemless transition to AAF, the first role we use for our clients will be called org.onap.aai.ws.all and will contain all read and write permissions for A&AI web services. This role will be assigned to all users/applications which access A&AI web services