if you want to ensure both, you'd do something like:

definition folder {
  relation reader: user
  permission read = reader
}

definition document {
  relation folder: folder
  relation viewer: user
  permission view = viewer & folder->read
}