- allow empty response for empty rules.Resource, - rely more on rules.Access instead of bool, - update resource test