it's basically the same syntax as a relation, except the permission can represent a whole lot of walking between the subject and the object, where a relation declaration has to be a direct connection