definition tokened_resource {
  relation resource: resource
  relation token: access_token
  permission view = resource->view & token->user
}