definition user {}

definition department {
  relation manager: user
  relation parent: department
  permission view = manager + parent->view
}