I tried

definition group {
relation manager: user
relation member: user
permission view_member = manager + member
}

but am not sure what the lookup-resources call should be