you'd likely use

relation permission_set: role

, because arrows (

->

) ignore subject relations