definition organization {
  relation admin: group#member
}

definition division {
  relation parent_org: organization
  relation viewer: group#member
  permission view = viewer + parent_org->admin
}