definition user {
    relation supervisor : user
    permission approve = supervisor + supervisor->approve
}

definition expense_report {
    relation owner : user

    permission edit = owner
    permission delete = owner
    permission approve = owner->approve
}