definition platform {
  relation resource_viewer: role#member
  permission view_all_resources = resource_viewer
}

definition resource {
  relation platform: platform
  relation viewer: user
  permission view = viewer + platform->view_all_resources
}