and my colleague had modeled things as

definition role {
  relation bearer: user
  permission assume: bearer
}

and then was defining the object-level permissions in terms of walking to that

assume