definition resource {
  relation organization: organization
  relation viewer: user
  relation editor: user

  permission edit = editor
  permission local_only_view = viewer + edit
  permission view = local_only_view + organization->admin
}