How to take cascading permissions and optimize them to prevent duplicate checks (eg: If a user has edit, they also have view, and if they have admin they have edit and view) Bonus points if you can show how to integrate non cascading permissions into this (eg: Admin gives view and edit, but not share) How to handle default permissions on a resource. (eg: Group Y immediately gets admin rights to every resource (event newly created ones) while Group Z only gets view rights Just some thoughts, more to come

^ any admin can also edit and view but not share

default permissions you handle by writing a relationship to a singleton:

definition kind {
  relation admin: user
}

definition resource {
  relation admin: user | kind#admin
  permission can_admin = admin
}

then write

resource:whateverresourceitis#admin@kind:resource#admin

and

kind:resource#admin@user:fred