definition resource {
  relation viewer: user
  relation banned: user
  permission view = viewer - banned
}