if you absolutely wanted to do only one relationships per alert, and you wanted to front-load by creating more relationships between users and companies, you could do:

/** More denormalized, assumes the all users belong to only one company, and you can infer an alert's company by its creator user */
definition user {
    relation company: company
    permission company_users = company->user
}

definition company {
    relation user: user
}

definition alert {
    relation creator: user

    permission update_alert = creator
    permission delete_alert = creator->company_users
    permission get_alert = creator->company_users
    permission get_metric_alert_history = creator->company_users
}