if you were modeling a traditional RBAC-style permissions system, you could think of

relation

as a role, and

permission

as, well, a permission based on those role(s)