// What the user alone may do: read where the user holds the read grant, write or
// destroy where the user holds the write grant. The real set must never allow more.
@id("user-may-read")
permit (principal, action == Action::"read", resource)
when { resource in context.user.read_groups };

@id("user-may-write")
permit (principal, action in [Action::"write", Action::"destroy"], resource)
when { resource in context.user.write_groups };