definition resource {
  relation reader: user#member
  relation service_reader: service_account#member
  permission read = write + reader
  permission service_read = service_reader
}