here for example is a ruleset to allow kubectl get *, including kubectl -n <namespace> get * but not kubectl get secrets

The policies are defined jsonnet (== json with wings) so one could create a library of common used rules and import per-project!