rule no_func deny functions sum avg
users %@% match any rules no_func