---
conf:
  policy:
    secret_project_match: project:%(target.secret.project_id)s
    secret_creator_user: user:%(target.secret.creator_id)s
    container_project_match: project:%(target.container.project_id)s
    container_creator_user: user:%(target.container.creator_id)s
...