and re your question about relation direction, it depends on the questions you're trying to ask. i've found that it's helpful when writing schema to think about a permission as being a walk from the object to the subject