SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

Looks like the solution was in front of me
```
definition account {
}

definition app {
    // TIP Sensor relations
    relation app_user: account
    relation app_viewer: account

    permission create_session = app_user
    permission view_app = app_viewer + create_session
}

definition app_session {
    relation app: app
    relation owner: account
    relation shared_delete_access: account
    relation shared_edit_access: account
    relation shared_view_access: account

    permission delete_session = (owner + shared_delete_access) & app->app_user
    permission edit_session = (delete_session + shared_edit_access) & app->app_user
    permission view_session = (edit_session + shared_view_access) & app->app_user
    permission can_share = owner & app->app_user
}
```