definition access_token {
  relation user: user
}

definition resource {
  relation viewer: user |  role#member
  relation viewer_token: access_token
  permission view = viewer + (viewer_token->(rewritetouser)->user & check viewer)
}