Thank you for the advice! I will definitely consider removing the intersection. To clarify what I meant by "safety": in our service, a content item can be toggled between enabled and disabled, and independently it can be set to allowed or not-allowed. The business rule is that members can only view the content if it is both enabled AND allowed. If we simplify the schema to just permission

member_view = allowed->is_member

, my concern is about application-side implementation bugs. For example, when the application updates a content item to be disabled, a bug or a partial failure might cause it to forget to remove the allowed tuple. If that happens, members would still be able to view the disabled content.