diag

     +--+   +--+       +--+
  +-¤|p1|¤--|g1|¤------|u1|
  |  +--+  /+--+      /+--+
  |       /          /     
  |  +--+¤          /      
  +-¤|p2|          /       ¤=connector
  |  +--+¤        /        
  |       \      /         
  |  +--+  \+--+¤          
  +-¤|p3|¤--|g2|       +--+
  |  +--+   +--+¤------|u2|
  |                    +--+
  |                        
  |         +--+       +--+
  +---------|mk|¤------|u3|
            +--+       +--+

  type/contentname.keyname : key -> contents

  pass/<pname>.<gname> : <gtoken> -> <pass>
  pass/<pname>.admin : <atoken> -> <pass>
  
  group/<gname>.<uname> : <utoken> -> <gtoken>
  group/<gname>.admin : <atoken> -> <gtoken>
  group/admin.<uname> : <utoken> -> <atoken>
  
  user/<uname> : <upass> -> <utoken>
  user/<uname>.admin : <atoken> -> <utoken>