_rep_policy.xml

<?xml version="1.0" encoding="UTF-8"?>
<jcr:root xmlns:jcr="http://www.jcp.org/jcr/1.0" xmlns:rep="internal"
    jcr:primaryType="rep:ACL">
    <allow
        jcr:primaryType="rep:GrantACE"
        rep:principalName="administrators"
        rep:privileges="{Name}[jcr:all]"/>
    <allow0
        jcr:primaryType="rep:GrantACE"
        rep:principalName="contributor"
        rep:privileges="{Name}[jcr:read]"/>
</jcr:root>