watcher/etc/watcher/policy.json

{
    "admin_api": "role:admin or role:administrator",
    "show_password": "!",
    "default": "rule:admin_api"
}