in this example, a user can view if they are (a) a viewer of the particular resource (b) a viewer on the resource's type(s) or (c) an admin on the parent tenant