Configuration: simplest authorization

[BayerMeister]

The page about configuration offers a very simple way to authenticate. There is however no mention about an equivalent way to set up authorization.
The ACL page goes into detail here, but it is not obvious if both approaches can be combined.

I would like to see some lines added, but I have no idea if this is the correct way to do it.
Here is what we've got:

security:
    debugger: true  # debugger bar panel

    users:
        johndoe: secretpassword
        mikesmith: anotherpassword

    roles:
        guest:
        member:
        admin: [member]  # admin extends member

    resources:
        file:

And here's what i would like to add at the end, if something like that exists (pseudo-code):

security:
    allow(member, file, read)
    addRole(johndoe, [admin, ...])
    addRole(mikesmith, member)

As soon as I find out how this can be done properly, I'll happily add it to both EN and CS documentation.

As mentioned on the ACL page I know there is this option:

services:
    acl:
        factory: Nette\Security\Permission
        setup:
            - allow(member, file, read)
            - addRole(johndoe, [admin, ...])
            - addRole(mikesmith, member)

But that does not combine well, or does it? If that is the only way, maybe it should be added to the configuration page.

[f3l1x]

I'm not sure if it's clear Nette-way how to define ACL, thus I don't known it should be in docs. What do you think guys? @dg @JanTvrdik @chemix @matej21?

[chemix]

I'm doing ACL simple way by dynamic user auth with DI configuration via neon file
(https://doc.nette.org/en/2.4/access-control#toc-usage-in-application)

services:
    authorizator:
        class: Nette\Security\Permission
        setup:
            - addRole('guest')
            - addRole('user')
            - addRole('admin', 'user')
            - addRole('root', 'admin')

            - addResource('User')
            - allow('admin', 'User', 'view')
            - allow('admin', 'User', 'add')
            - allow('admin', 'User', 'edit')
            - allow('admin', 'User', 'remove')

And if I understand question from @BayerMeister, he wants to add to this https://github.com/nette/security/blob/master/src/Bridges/SecurityDI/SecurityExtension.php extension section for "setup" ACL tree (allow, deny) ? Isn't it?