definition tenant {
  relation admin: user
}

definition resourcetype {
   relation viewer: user
}

definition resource {
  relation parent_tenant: tenant
  relation type: resourcetype
  relation viewer: user
  permission view = viewer + type->viewer + parent_tenant->admin
}