if you want to ensure both, you'd do something lik...
# spicedb
j
if you want to ensure both, you'd do something like:
Copy code
definition folder {
  relation reader: user
  permission read = reader
}

definition document {
  relation folder: folder
  relation viewer: user
  permission view = viewer & folder->read
}