definition group {
  relation parent: group
  relation direct_member: user
  permission member = direct_member + parent->member
}