definition resource {
  relation viewer: user | user with valid_2fa
}