definition user {
        relation member_group: group
        permission can_be_viewed = member_group->manager
}