definition user {}

definition vendor {
   relation viewer: user
}

definition tenant {
   relation parent_vendor: vendor
   relation viewer: user
   permission view = viewer + parent_vendor->viewer
}