For large number of users, managing access for entire groups can be more efficient than assigning roles to individual users. User groups essentially define that, if you’re part of a group, you can access certain resources or perform specific actions. Let’s demonstrate how this can be modeled using a simple project management system scenario. 
entity user {}

entity organization {

    // organizational roles
    relation admin @user
    relation member @user

}

entity team {

    // represents owner or creator of the team
    relation owner @user

    // represents direct member of the team
    relation member @user

    // reference for organization that team belong
    relation org @organization

    // organization admins or owners can edit, delete the team details
    permission edit = org.admin or owner
    permission delete = org.admin or owner

    // to invite someone you need to be admin and either owner or member of this team
    permission invite = org.admin and (owner or member)

    // only owners can remove users
    permission remove_user =  owner
}

entity project {

    // references for team and organization that project belongs
    relation team @team
    relation org @organization

    permission view = org.admin or team.member
    permission edit = org.admin or team.member
    permission delete = team.member
}

​
Breaking Down

​
User Entity:

entity user {}
This is a basic entity representing a user in the system. It doesn’t have any specific relations or permissions defined.

​
Organization Entity:

entity organization {
    relation admin @user
    relation member @user
}
The organization entity has two relations: admin and member, both referencing users. This allows users to be assigned roles within an organization.

​
Team Entity:

entity team {
    relation owner @user
    relation member @user
    relation org @organization

    permission edit = org.admin or owner
    permission delete = org.admin or owner
    permission invite = org.admin and (owner or member)
    permission remove_user = owner
}
The team entity has three relations: owner (a user), member (users), and org (the organization it belongs to). It defines four permissions:
  • edit: Organization admins or team owners can edit the team.
  • delete: Organization admins or team owners can delete the team.
  • invite: Organization admins who are also either team owners or members can invite others.
  • remove_user: Only team owners can remove users from the team.

​
Project Entity:

entity project {
    relation team @team
    relation org @organization

    permission view = org.admin or team.member
    permission edit = org.admin or team.member
    permission delete = team.member
}
The project entity has two relations: team and org, representing the team and organization it belongs to. It defines three permissions:
  • view: Organization admins or team members can view the project.
  • edit: Organization admins or team members can edit the project.
  • delete: Only team members can delete the project.
This model establishes a hierarchy where organizations contain teams, which in turn contain projects. It also defines various permissions based on user roles within organizations and teams.

​
More Advance Example

See our Facebook Groups example to learn how to apply user groups in a real-world scenario.