Can Manage Instances: Custom Policy
In detail, this means that these users can take this action, provided they pass all of the checks described above first:
These rules are processed in order:
If no rules match, deny all other users.