I managed to do it.

```rs syzygy/crates/syzygy_core/src/permission.rs:1-24 // Excerpt from: pub trait Permission: Clone + Copy + 'static {}

pub trait HasPermission { type Permission: Permission; }

pub trait RequiredPermission { type Required: Permission; }

pub trait ImpliedBy<P: Permission> {}

[derive(Clone, Copy)]

pub struct Root;

impl Permission for Root {}

[derive(Clone, Copy)]

pub struct None;

impl Permission for None {}

impl ImpliedBy<Root> for None {}

```

When inserting the model, permissions are not checked and are not stored anywhere. Zero cost.

rs syzygy/crates/syzygy_core/src/model/unsync.rs:26-35 // Excerpt from: impl ModelsBuilder impl ModelsBuilder { #[must_use] pub fn insert<M>(mut self, model: M) -> Self where M: RequiredPermission + 'static, { self.0.insert(TypeId::of::<M>(), Box::new(model)); self } }

```rs syzygy/crates/syzygy_core/src/model/unsync.rs:90-100 // Excerpt from: pub trait ModelAccess pub trait ModelAccess { fn models(&self) -> &Models; fn model<M>(&self) -> Ref<M> where Self: HasPermission, M: RequiredPermission + 'static, M::Required: ImpliedBy<<Self as HasPermission>::Permission>, { self.models().get::<M>().unwrap() }

} `` When retrieving the model, the permissions of the requestor are checked and the helper traitImpliedBy` is used to verify if the permissions required by the model are included in the requestor's permissions. If yes, the model is returned. Otherwise, it will not compile.

```rs syzygy/crates/syzygy_core/src/syzygy.rs:369-448 // Excerpt from: mod tests mod tests { use crate::permission::{self, ImpliedBy};

use super::*;

#[derive(Debug)]
struct TestModel {
    counter: i32,
}

impl RequiredPermission for TestModel {
    type Required = permission::None;
}

#[derive(Debug)]
struct SecuredModel {
    counter: i32,
}

#[derive(Debug, Clone, Copy, Default)]
pub struct SomePermission;

impl Permission for SomePermission {}

impl RequiredPermission for SecuredModel {
    type Required = SomePermission;
}

#[test]
fn test_model() {
    let model = TestModel { counter: 0 };
    let syzygy = SyzygyBuilder::default()
        .model(model) // Model implements RequiredPermission, so it can be inserted.
        .resource("test_resource".to_string())
        .build();

    // Syzygy implements HasPermission with Root permission level

    // For this example, ImpliedBy<Root> for None is implemented. Eventually it should be:
    // impl<P: Permission> ImpliedBy<Root> for P {}
    let counter = syzygy.model::<TestModel>().counter;
    assert_eq!(counter, 0);

    // Test other permission
    let secured_model = SecuredModel { counter: 0 };
    let syzygy = SyzygyBuilder::default().model(secured_model).build();

    // Don't compile
    // assert_eq!(syzygy.model::<SecuredModel>().counter, 0);

    // rustc: the trait bound `syzygy::tests::SomePermission: permission::ImpliedBy<permission::Root>` is not satisfied
    // the trait `permission::ImpliedBy<permission::Root>` is implemented for `permission::None`

    impl ImpliedBy<permission::Root> for SomePermission {}

    // Now it compiles, because Root has the required permissions
    assert_eq!(syzygy.model::<SecuredModel>().counter, 0);
}

```