It indeed feels like somewhere an & should be involved. The establish a relation must be interpreted as an action of the application. So, assume two types A and B and assume editor relations for A and B and a user who can be editor for both. The user should only be allowed to establish a relation in the application (or do anything else with A and B instances in the application for that matter) iff the user is editor for both the instance of A and for the instance of B. Is this any clearer?