issue 2- (which is similar to above issue)--------------------------------------------- look in this relations , if i assign same user to another ad_account: tuk-parle, then user:josh can access the module:insights as viewer and here also i cant distinguish the role for two other ad_account // Assigning Ad Accounts to a Tenant tenant:tesco-uk#advertising@ad_account:TUK-dove tenant:tesco-uk#advertising@ad_account:TUK-dove tenant:tesco-uk#advertising@ad_account:TUK-parle // Assigning Brands to Ad Accounts ad_account:TUK-dove#branding@brand:dove adaccount:TUK-parle#branding@brand:parle // Assigning Modules to Brands // brand:dove#modules@module:insights brand:dove#modules@module:insights brand:dove#modules@module:measurement brand:dove#modules@module:booking brand:parle#modules@module:insights // Assigning Users to Ad Account (Users must belong to an Ad Account) ad_account:TUK-dove#members@user:josh ad_account:TUK-parle#members@user:josh ad_account:TUK-dove#members@user:ram ad_account:TUK-dove#members@user:shya ad_account:TUK-dove#members@user:ravi // Assigning Users to Roles in Modules (Role-Based Access) module:insights#planner@user:josh module:insights#approver@user:josh module:measurement#viewer@user:ram module:booking#approver@user:shyam module:insights#admin@user:ravi -------------------------------------------------------------------------------------------------- ------------------------------------------look here after changing relation , i cant differentiate , i want that tuk-dove should have viewer access in module:insight and same user:josh should have the approver access in ad_account:tuk-parle in module:insights. but it can be done here . Image #CHECK WATCHES FOR REFERNCES ---------------------------------------------- What changes should i do in schema according to you to achieve this To fix this problem According to you