definition user {
  relation organization: organization
  relation not_allowed_self_edit: user
  relation self: user

  permission view = self + organization->view_members
  permission edit = organization->edit_members - not_allowed_self_edit
}