definition user {}

definition user_group {
  relation member: user
  permission is_member = member
}

definition organization {
  relation admin: user
  relation user_group: user_group
  permission access = user_group->is_member + admin
}