definition group {
  relation direct_member: user
  relation parent: group
  relation admin: user
  permission admin = admin + parent->admin
  permission member = direct_member + parent->member
}