definition user {}

definition group {
  relation member: user
}

definition department {
  relation group: group
  permission view = group->member
}

definition organization {
  relation dept: department
  permission view = dept->view
}