these two posts provided some slightly more complex use cases that helped me understand how to structure things, and the google cloud IAM schema ended up matching the domain at my old company pretty well, so we used it pretty directly: https://authzed.com/blog/user-defined-roles and https://authzed.com/blog/google-cloud-iam-modeling