definition platform {
  relation admin: user
  relation log_reader: user
  permission read_logs = admin + log_reader
}