o1 { authorize(bob) :- not authorize(ann).
     authorize(ann) v authorize(tom) :- not -authorize(alice). }
o3 : o1 { -authorize(bob). }