caveat valid_user(expected_user string, current_user string) {
   expected_user == current_user
}

definition resource {
  relation viewer: user | access_token with valid_user
}