def make_policy(url, method, query_filter=None, post_filter=None,
                allowed=True):
    """
    Create a policy dictionary for the given resource and method.

    :param str url: the resource URL to grant or deny access to
    :param str method: the HTTP method to allow or deny
    :param dict query_filter: specific GET parameter names to require or allow
    :param dict post_filter: POST parameter names to require or allow
    :param allowed bool: whether this request is allowed
    """

    return {
        'url': url,
        'method': method,
        'allow': allowed,
        'query_filter': query_filter or {},
        'post_filter': post_filter or {},
    }