Since we aren't constraining individual

receivable_invoices

I think what we'd really prefer to do if it was possible is just have a permission on the vhost like this:

definition vhost {
    relation charge__write_without_delete: user_role#member
    relation credit__write_without_delete: user_role#member

    permission update_receivable_invoices = charge__write_without_delete with is_charge + credit__write_without_delete with is_credit
}