resource my_file {
	fn read(domain source) {
		allow(source, this, file, [ read open getattr ]);
	}
}

domain my_domain {
	my_file.read(this); // TODO: support 'this' as default argument
}