definition resource {
  relation reader: user#member | access_token | role#member | service_account#member
  relation writer: user#member | access_token | role#member | service_account#member
  relation manager: user#member | access_token | role#member | service_account#member
  permission manage = manager
  permission write = manage + writer
  permission read = write + reader
}