definition container {
  relation viewer: user
  permission view = viewer
}

definition resource {
  relation container: container
  relation viewer: user
  permission view = viewer + container->view
}