There is one moment. I don't add user relationship to resource directly. I add parent relationship to another resource and user has permission on this parent resource.