definition organization {
  relation owner: user
  permission can_create_role = owner
}