definition resource {
  relation viewer: user | user:*
  permission view = viewer
}