Resource Rules: Control which resources users can access using glob patterns. Types: config (training configs), hardware (GPU types), provider (cloud providers), output_path (output directories). Rules are allow or deny. Assign rules to levels to apply them to users. Example: team-x-* matches all configs starting with "team-x-".