module resource

type group_resource
  relations
    define view: [user, service-account, render, team#member, role#assignee] or edit
    define edit: [user, service-account, team#member, role#assignee] or admin
    define admin: [user, service-account, team#member, role#assignee]

    define get: [user, service-account, render, team#member, role#assignee] or view
    define create: [user, service-account, team#member, role#assignee] or edit
    define update: [user, service-account, team#member, role#assignee] or edit
    define delete: [user, service-account, team#member, role#assignee] or edit

    define get_permissions: [user, service-account, render, team#member, role#assignee] or admin
    define set_permissions: [user, service-account, render, team#member, role#assignee] or admin

type resource
  relations
    define view: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit
    define edit: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin
    define admin: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter]

    define get: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or view
    define update: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit
    define delete: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit

    define get_permissions: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin
    define set_permissions: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin

condition group_filter(requested_group: string, group_resource: string) {
  requested_group == group_resource
}