as an example, a user might be an `admin` on a res...