@hsluoyz RBAC with domain model only allows to assign users to roles per domain, but not global. This seems to be working for me I hope it is correct
[matchers] m = g(r.role, p.role, r.dom) && (r.dom == p.dom || p.dom == "global") && r.obj == p.obj && r.act == p.act
