module resource extend type folder relations define resource_view: [user, service-account, team#member, role#assignee] or resource_edit or resource_view from parent define resource_edit: [user, service-account, team#member, role#assignee] or resource_admin or resource_edit from parent define resource_admin: [user, service-account, team#member, role#assignee] or resource_admin from parent define resource_get: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_view or resource_get from parent define resource_create: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_edit or resource_create from parent define resource_update: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_edit or resource_update from parent define resource_delete: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_edit or resource_delete from parent define resource_get_permissions: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_admin or resource_get_permissions from parent define resource_set_permissions: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_admin or resource_set_permissions from parent type group_resource relations define view: [user, service-account, render, team#member, role#assignee] or edit define edit: [user, service-account, team#member, role#assignee] or admin define admin: [user, service-account, team#member, role#assignee] define get: [user, service-account, render, team#member, role#assignee] or view define create: [user, service-account, team#member, role#assignee] or edit define update: [user, service-account, team#member, role#assignee] or edit define delete: [user, service-account, team#member, role#assignee] or edit define get_permissions: [user, service-account, render, team#member, role#assignee] or admin define set_permissions: [user, service-account, render, team#member, role#assignee] or admin type resource relations define view: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit define edit: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin define admin: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] define get: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or view define update: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit define delete: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit define get_permissions: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin define set_permissions: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin condition group_filter(requested_group: string, group_resource: string) { requested_group == group_resource } condition folder_group_filter(requested_group: string, group_resources: list) { requested_group in group_resources }