definition role { relation assigned : group relation supervisor : role permission perform = supervisor + supervisor->perform } definition resource { relation performer : role#assigned permission perform = performer + (performer -> perform) }