should be pretty straight forward: - a

platform

relation on each resource (or at the root of folders) and add

+ platform->admin

to the local

admin

permission -

viewer

should have

user | group#member | user:*

to allow making it view-public