definition host {
  relation superuser: user
  permission can_access = superuser
}

definition port {
  relation host: host
  relation accessor: user
  permission can_access = accessor + host->can_access
}