ACL

group-name = user-list group-name-list

action = [CONSUME|
    PUBLISH|
    CREATE|
    ACCESS|
    BIND|
    UNBIND|
    DELETE|
    PURGE]

permission = \[\]

permission group-name [action] [queue=<queuename>]
[exchange=<exchangename>] [routingkey '=' <routingkey>]

example file:

qpid-acl allow create queue=\* temporary=true durable=false user=guest
qpid-acl allow bind queue=\* exchange=amq.topic routingkey=stocks.ibm.#
 owner=<self> user=guest
qpid-acl allow consume queue=<self> user=guest

There are a few pieces of nomenclature we need to agree on:
permissions
objects (queue,exchange, rkey...)
users (user, group,role?)
properties(temporary,durable,owner)