definition group1 {
  relation org: org1
  permission org_admin = org->admin
}