ACL

group <group-name> = [user-list] [group-name-list]

action = [consume|
    publish|
    create|
    access|
    bind|
    unbind|
    delete|
    purge]

permission = [allow|allow-log|deny|deny-log]
properties = [temporary|durable|owner]

permission <group-name> [action] [queue=<queuename>]
[exchange=<exchangename>] [routingkey '=' <routingkey>] [property = <properties>]

group admin tedr martin

qpid-acl carlt allow create queue=\* temporary=true durable=false 
qpid-acl guest allow bind queue=\* exchange=amq.topic routingkey=stocks.ibm.#
 owner=<self>
qpid-acl admin allow consume queue=<self>

There are a few pieces of nomenclature we need to agree on:
permissions
objects (queue,exchange, rkey...)
users (user, group,role?)