definition user {}

definition apikey {
  relation user: user
}

definition document {
  relation viewer: user | apikey#user
  permission view = viewer
}