user:User1@pve:1:
user:User2@pve:1:

group:GroupA:User1@pve,User2@pve:
group:GroupB:User1@pve,User2@pve:

role:Role1:VM.PowerMgmt:
role:Role2:VM.Console:
role:Role3:VM.Console:

acl:1:/vms:User1@pve:Role1:
acl:1:/vms/100/a/b:User1@pve:Role2:

acl:0:/kvm:User2@pve:Role2:
acl:0:/kvm/vms:User2@pve:Role1:
acl:0:/kvm/vms/100/a:User2@pve:Role3: