you should define a single, combined permission on...
# spicedb
j
you should define a single, combined permission on the
container
, and then arrow to that