Hello everyone. I have created schema, test relationships and assertion like that:

Schema:
    definition user {}

    definition element {
        relation parent: element
        relation directly_include_user: user | user:*
        relation directly_exclude_user: user
        permission access_element = directly_include_user + parent->directly_include_user - directly_exclude_user - parent->directly_exclude_user
    }

Test Relationship:
    element:X#directly_include_user@user:*
    element:Y#directly_include_user@user:included_user
    element:YA#parent@element:Y
    element:YA#directly_include_user@user:should_not_included

Assertions:
    assertTrue:
        - element:X#access_element@user:user
        - element:X#access_element@user:anonymous
        - element:Y#access_element@user:included_user
        - element:YA#access_element@user:included_user
    assertFalse:
        - element:Y#access_element@user:excluded_acc
        - element:YA#access_element@user:should_not_included <this creates error>

I have business requirements that: 1. there could be unlimited nesting of elements 2. if parent does not allow to

access_element

, none of the childs should be able to

access_element

that element even if relation to that element is created 3. by default all users can

access_element

(I assume this should be done by just adding wildcard relationship as it is for element X) But I'm still struggling with point number 2 as element:YA should not

access_element

by

user:should_not_included

. Is there a way to modify in some way permissions to support this use case?