loopback/test/fixtures/access-control/common/models/account.json

{
  "name": "accountWithReplaceOnPUTtrue",
  "plural": "accounts-replacing",
  "relations": {
    "transactions": {
      "model": "transaction",
      "type": "hasMany"
    },
    "user": {
      "model": "user",
      "type": "belongsTo",
      "foreignKey": "userId"
    }
  },
  "acls": [
    {
      "accessType": "*",
      "permission": "DENY",
      "principalType": "ROLE",
      "principalId": "$everyone"
    },
    {
      "accessType": "*",
      "permission": "ALLOW",
      "principalType": "ROLE",
      "principalId": "$owner"
    },
    {
      "permission": "DENY",
      "principalType": "ROLE",
      "principalId": "$owner",
      "property": "deleteById"
    },
    {
      "accessType": "*",
      "permission": "DENY",
      "property": "find",
      "principalType": "ROLE",
      "principalId": "$dummy"
    }
  ],
  "properties": {},
  "replaceOnPUT": true
}