yeah I guess that works - i guess notinherited is something manual in the same way noaccess would be? it feels like this could somehow be modelled such that a manual relation isn't required - but i haven't really delved into the implementation so maybe it's non-trivial