definition access_token {}

definition user {
  relation inheritor: access_token
  permission member = inheritor
}

definition service_account {
  relation inheritor: access_token
  permission member = inheritor
}

definition role {
  relation inheritor: user#member | access_token | service_account#member
  relation parent_role: role#member
  permission member = inheritor + parent_role
  permission parent = parent_role
}

definition resource {
  relation reader: user#member | access_token | role#member | service_account#member
  relation writer: user#member | access_token | role#member | service_account#member
  relation manager: user#member | access_token | role#member | service_account#member
  permission manage = manager
  permission write = writer + manage
  permission read = write + reader
}