interface CheckPermissionParams {
  subject: string;     // "user:usr_abc123" or "group:grp_abc123"
  relation: string;    // "viewer", "editor", "admin", "owner", "member"
  object: string;      // "project:proj_abc123", "organization:org_abc123"
}

interface GrantPermissionParams {
  subject: string;
  relation: string;
  object: string;
}

interface ListObjectsParams {
  subject: string;
  relation: string;
  objectType: string;    // "project", "organization", "document"
  pageSize?: number;
  pageToken?: string;
}

interface ObjectList {
  objects: string[];           // ["project:proj_abc123", "project:proj_xyz789"]
  nextPageToken: string | null;
}

interface SubjectList {
  subjects: string[];          // ["user:usr_jane", "group:grp_engineering"]
  nextPageToken: string | null;
}

interface PermissionTree {
  type: "union" | "intersection" | "exclusion" | "leaf" | "computed" | "tuple_to_userset";
  subject?: string;
  relation?: string;
  children?: PermissionTree[];
}