hm not sure. Want to be able to assign permissions to users directly (besides inferring them through other permissions/relations). Probably I should model that as a "direct user" relation.