definition organization {
  relation tagger: user
  permission can_tag = tagger
}

definition document {
  relation org: organization
  permission can_tag = org->can_tag
}