this was explicitly designed to handle ABAC-like designs on top of the relationship-based permissions