the iam model assumes that there are static relations and permission definitions, but that you can bundle them into a role however you like and apply them to a resource however you like