I was playing around with relations and seems like relations are a way to represent a role on a subject. So for a purely RBAC system with roles on specific resources, is it ok to define an object with just relations and no permission and then simply query the relations between the subject and the resource?