> since it requires the user to have a direct relationship on "resource" you can reference a permission on the right hand side too