definition resource {
  relation reader: role
  permission view = reader->bearer
}