definition user {}

definition organization {
  relation member: user
  permission view = member
}

definition resource {
  relation viewer: user
  relation org: organization

  permission view_local = viewer
  permission view = view_local + org->view
}