I slapped together a really basic example of your problem as I understood it. Basically the idea is to create a type for running machines and check the permission through that type. https://play.authzed.com/s/XTGuyZNQxGzD/schema (take a look at test relationships and assertions)