sidergoal

i want to make an rbac system with the following conditions :

• users, groups, roles
• users can belong to groups
• users and groups can be assigned roles
  i still don't understand how to do the model.conf properly

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[role_definition]
user_role   = _, _    # user → role
user_group  = _, _    # user → group
group_role  = _, _    # group → role
ownership   = _, _    # user → resource

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = (
      user_role(r.sub, "admin")                 # admin → full access
      || ownership(r.sub, r.obj)                # owner of resource → full access
      || (
          user_role(r.sub, p.sub)
          || (user_group(r.sub, group) && group_role(group, p.sub))
         )
         && r.obj == p.obj
         && r.act == p.act
    )

i currently have this but
(user_group(r.sub, group) && group_role(group, p.sub))
idk what to put insted of "group"