# spicedb


03/08/2022, 8:21 PM
hey all - i'm trying to represent a default set of permissions for a group, for all newly created resources. this alone is straightforward enough, we create our resource with an inherit relation to a global resource that allows roles to give RW access. then all resources are created with references to this global resource this doesn't work in the subtractive case: if we have a group admin that by default has RW on all resources by defualt, but only R on a specific one we specify. It's non obvious to me how to represent this - maybe I'm missing something obvious? Here's what I have at the moment: