definition group {
        relation manager: user
        relation member: user
        permission view_member = manager + member
}

definition user {
        relation member_group: group
        permission can_be_viewed = member_group->view_member
}