1# Group-owned resource example23Define a group, its membership relation, and resources that reference it:45```ts6import { s } from "@nzip/lofi/schema";7import { groupMembershipTable } from "@nzip/lofi/access";89export const app = s.defineApp({10 workspaces: s.table({ name: s.string() }),11 workspaceMembers: groupMembershipTable("workspaces"),12 documents: s.table({ workspaceId: s.ref("workspaces"), title: s.string() }),13});14```1516```ts17import { defineAccessPolicies, groupAccess } from "@nzip/lofi/access";18import { app } from "./schema.ts";1920export default defineAccessPolicies(app, [groupAccess({21 groups: app.workspaces,22 members: app.workspaceMembers,23 resources: app.documents,24 groupId: "workspaceId",25})]);26```2728```ts29import { createGroupOperations } from "@nzip/lofi/access";30import { app } from "./schema.ts";3132const groups = createGroupOperations({33 groups: app.workspaces,34 members: app.workspaceMembers,35});36const { group } = await groups.createGroup({ name: "Release team" });37await groups.addMember(group.id, recipientIdentity, "contributor");38await groups.changeRole(group.id, recipientIdentity, "writer");39await groups.removeMember(group.id, recipientIdentity);40```4142Readers can read. Contributors can create and edit their own rows. Writers can edit any group row.43Admins can do everything writers can and manage membership. `leaveGroup` removes the current44principal's membership. Managed sync is required for every group operation. The group's creator45additionally keeps a permanent superseat: demoting or removing them does not end their ability to46manage the group — see [Permission templates](../permissions.md#fixed-group-roles) before building47handover flows.