definition user {}

definition business_unit {
    relation account_manager: user
    relation sales_director: user
    relation member: user
}

definition order {
    relation unit: business_unit
    relation creator: user

    permission view = unit->member
    permission update = unit->sales_director + creator // a director can always update orders, and so can the person who originally placed the order
}