definition group {
    relation admin: user
    relation direct_member: user | group#member
    permission member = direct_member + admin
}

definition user {}
definition organization {
    relation reader: user | group#member
    permission read = reader
}