definition user {}
definition organization {
  relation admin: user
}

definition resource {
  relation owner: user | organization
  permission view = owner + owner->admin
}