I am just wondering how would the policy definition would look if we are to support permission at individual resource level.

eg, userid#1 has access to read ResourceTypeX resourceId#1
userid#1 has access to write ResourceTypeX resourceId#1
userId#2 has access to read ResourceTypeX resourceId#122
userId#2 has access to write ResourceTypeX resourceId#122
RoleX has access to read/write ResourceTypeX resourceIdId#* (all instances of a resourceType)

I would also need policy that says a user is allowed to create a particular resourceType. E,g
RoleX can create a resource of type ResourceTypeX
RoleY can create a resource of type ResourceTypeY