definition group {
    relation member: user | group#member
}
definition user {}
definition organization {
    relation reader: user | group#member
    permission read = reader
}