SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

Here's where I am at now:
```definition user {}

definition team {
    relation member: user
}

definition parent {
    relation direct_editor: user | team#member
    relation direct_creator: user | team#member

    permission editor = direct_editor
    permission creator = direct_creator

}

definition resource {
    relation parent: parent
    relation direct_editor: user | team#member
    relation direct_creator: user | team#member

    relation feature_flag: resource#direct_creator | resource#direct_editor

    permission editor = (direct_editor + parent->editor) & feature_flag
    permission creator = (direct_editor + parent->editor) & feature_flag
}

definition child {
    relation parent: resource
    
    relation direct_editor: user | team#member
    
    permission feature_flag = parent->feature_flag  // settable on parent only

    permission editor = (direct_editor + parent->editor) & feature_flag
    permission creator = (direct_editor + parent->editor) & feature_flag
}````