this separation of "which object are we talking about" from "what are they able to do" is pretty well-captured by the "google cloud iam" pattern in this blog post: https://authzed.com/blog/google-cloud-iam-modeling