In another terminal, create a policy that allows root user all access and for all other users denies `PutObject`:

```sh
cat > example.rego <<EOF
package httpapi.authz

import input

default allow = false

# Allow the root user to perform any action.
allow {
 input.owner == true
}

# All other users may do anything other than call PutObject
allow {
 input.action != "s3:PutObject"

  The executioner's argument was, that you couldn't cut off a
head unless there was a body to cut it off from:  that he had
never had to do such a thing before, and he wasn't going to begin
at HIS time of life.

  The King's argument was, that anything that had a head could be
beheaded, and that you weren't to talk nonsense.

  The Queen's argument was, that if something wasn't done about

     */
    private byte[] raw;
    private NdrBuffer buf;

    @BeforeEach
    void setUp() {
        // 10 bytes is more than enough for the 2-byte short
        raw = new byte[10];
        buf = new NdrBuffer(raw, 0);
    }

    /**
     * Validate that the constructor masks the supplied value to its
     * lowest 8 bits (NdrShort incorrectly masks to 8 bits even though it's a short).
     */

   * That may happen later by the connection pool thread.
   */
  fun cancel()

  /**
   * Carries an exchange. This is usually a connection, but it could also be a connect plan for
   * CONNECT tunnels. Note that CONNECT tunnels are significantly less capable than connections.
   */
  interface Carrier {
    val route: Route

    fun trackFailure(

    /**
     * Gets the total number of records that match the search criteria.
     *
     * @return The total record count
     */
    public long getAllRecordCount() {
        return allRecordCount;
    }

    /**
     * Gets the relation type indicating how the record count should be interpreted.
     *
     * @return The record count relation (e.g., "eq" for exact, "gte" for greater than or equal)
     */

      }
    },
    // It really seems like this should be faster than TO_BYTE_ARRAY_NEW_STRING.  But it just isn't
    // my best guess is that the jdk authors have spent more time optimizing that callpath than this
    // one. (StringCoding$StringDecoder vs. StreamDecoder).  StringCoding has a ton of special cases
    // theoretically we could duplicate all that logic here to try to beat 'new String' or at least
    // come close.

  }

  /**
   * Returns the {@code int} value that, when treated as unsigned, is equal to {@code value}, if
   * possible.
   *
   * @param value a value between 0 and 2<sup>32</sup>-1 inclusive
   * @return the {@code int} value that, when treated as unsigned, equals {@code value}
   * @throws IllegalArgumentException if {@code value} is negative or greater than or equal to
   *     2<sup>32</sup>
   * @since 21.0
   */

   * <p>If {@code value} is within the range {@code [min..max]}, {@code value} is returned
   * unchanged. If {@code value} is less than {@code min}, {@code min} is returned, and if {@code
   * value} is greater than {@code max}, {@code max} is returned.
   *
   * <p><b>Java 21+ users:</b> Use {@code Math.clamp} instead. Note that that method is capable of
   * constraining a {@code long} input to an {@code int} range.
   *

    means

    (a) that the initial Contributor has attached the notice described
        in Exhibit B to the Covered Software; or

    (b) that the Covered Software was made available under the terms of
        version 1.1 or earlier of the License, but not also under the
        terms of a Secondary License.

1.6. "Executable Form"
    means any form of the work other than Source Code Form.

1.7. "Larger Work"

/**
 * A collection that supports order-independent equality, like {@link Set}, but may have duplicate
 * elements. A multiset is also sometimes called a <i>bag</i>.
 *
 * <p>Elements of a multiset that are equal to one another are referred to as <i>occurrences</i> of
 * the same single element. The total number of occurrences of an element in a multiset is called