/**
 * paid features
 */
definition feature {
    /** which companies have access to the feature */
    relation enabled_for: company

    /** give access to a specific user or role group */
    relation allow_access: role#member | user

    /** restrict access to a specific user */
    relation disallow_access: user

    /** access determines who have access to the feature */
    permission access = (allow_access & enabled_for->member) - (disallow_access & enabled_for->member)
}

definition role {
    relation company: company
    relation member: user
    relation built_in_role: company

    /** delete roles that are not built in roles */
    permission delete = company->manage_roles - built_in_role->manage_roles

    /** add users to roles */
    permission add_user = company->manage_roles

    /** remove users from roles */
    permission remove_user = company->manage_roles

    /** add and remove permissions to roles */
    permission update = company->manage_roles

    /** permission to check that the user has at least one role */
    permission has_role = member
}

definition company {
    relation parent: company

    relation user: user
    permission direct_member = user
    permission member = direct_member + parent->member + platform_admin

    relation company_editor: role#member
    relation company_deleter: role#member
    permission edit_company = (company_editor + parent->edit_company + delete_company) & member
    permission delete_company = (company_deleter + parent->delete_company) & member
        
        ...
}