Forbid downloading of attachments "private_*" by role-based rule