allow vendor_rfs_access self:capability sys_admin;