docs: def _CreateReadAccessHelper(self):
      """Creates a CheckAccessHelper for controlling read access.
  
      This function and _CreateQueryAccessHelper essentially define GRR's ACL
      policy. Please refer to these 2 functions to either review or modify
      GRR's ACLs.
  
      Read access gives you the ability to open and read aff4 objects for which
      you already have the URN.
  
      Returns:
        CheckAccessHelper for controlling read access.
      """
      h = CheckAccessHelper("read")
  
      h.Allow("aff4:/")
  
      # In order to open directories below aff4:/users, we have to have access to
      # aff4:/users directory itself.
      h.Allow("aff4:/users")
  
      # User is allowed to access anything in their home dir.
      h.Allow("aff4:/users/*", self._IsHomeDir)
  
      # Administrators are allowed to see current set of foreman rules.
      h.Allow("aff4:/foreman", self._UserHasAdminLabel)
  
      # Querying is not allowed for the blob namespace. Blobs are stored by hashes
      # as filename. If the user already knows the hash, they can access the blob,
      # however they must not be allowed to query for hashes.
      h.Allow("aff4:/blobs")
      h.Allow("aff4:/blobs/*")
  
      # The fingerprint namespace typically points to blobs. As such, it follows
      # the same rules.
      h.Allow("aff4:/FP")
      h.Allow("aff4:/FP/*")
  
      # The files namespace contains hash references to all files downloaded with
      # GRR, and is extensible via Filestore objects. Users can access files for
      # which they know the hash.
      # See lib/aff4_objects/filestore.py
      h.Allow("aff4:/files")
      h.Allow("aff4:/files/*")
  
      # Namespace for indexes. Client index is stored there.
      h.Allow("aff4:/index")
      h.Allow("aff4:/index/*")
  
      # Keyword-based Client index.
      h.Allow("aff4:/client_index")
      h.Allow("aff4:/client_index/*")
  
      # ACL namespace contains approval objects for accessing clients and hunts.
      h.Allow("aff4:/ACL")
      h.Allow("aff4:/ACL/*")
  
      # stats namespace is for different statistics. For example, ClientFleetStats
      # object is stored there.
      h.Allow("aff4:/stats")
      h.Allow("aff4:/stats/*")
  
      # Configuration namespace used for reading drivers, python hacks etc.
      h.Allow("aff4:/config")
      h.Allow("aff4:/config/*")
  
      # Namespace for flows that run without a client. A lot of internal utilitiy
      # flows and cron jobs' flows will end up here.
      h.Allow("aff4:/flows")
      h.Allow("aff4:/flows/*")
  
      # Namespace for hunts.
      h.Allow("aff4:/hunts")
      h.Allow("aff4:/hunts/*")
  
      # Namespace for cron jobs.
      h.Allow("aff4:/cron")
      h.Allow("aff4:/cron/*")
  
      # Namespace for audit data.
      h.Allow("aff4:/audit")
      h.Allow("aff4:/audit/*")
      h.Allow("aff4:/audit/logs")
      h.Allow("aff4:/audit/logs/*")
  
      # Namespace for clients.
      h.Allow(self.CLIENT_URN_PATTERN)
      h.Allow(self.CLIENT_URN_PATTERN + "/*", self._HasAccessToClient)
  
      # Allow everyone to read the artifact store.
      h.Allow("aff4:/artifact_store")
      h.Allow("aff4:/artifact_store/*")
  
      return h