ruby: generate access_rule