definition resource {
  relation viewer: user
  relation org_viewer: organization#member
  permission directly_view = viewer
  permission view = directly_view + org_viewer
}