I suppose there is no way to have a permission check a permission of another type? Ie.

User {}
Key {
  relation owner: User
}
Org {
  relation admin: User
  permission write = admin
}
Project {
  relation owner: Org
  relation key: Key
  permission write = [ would like this to be if Key's owner (which is a user) has org write ]
}