definition group {
  relation member: user
}

definition resource {
  relation viewer: group#member | user
  relation writer: group#member | user

  permission write = writer
  permission view = viewer + write
}