version 1 .

Account = <pwent {
  name: string,
  uid: int,
  gid: int,
  info: string,
  home: string,
  shell: string,
}> .

Group = <grent {
  name: string,
  gid: int,
}> .

GroupMember = <group-member @uid int @gid int> .

EnsureAccount = <ensure-account @name string @spec Spec> .
EnsureGroup = <ensure-group @name string @spec Spec> .

Spec =
/ @userAccount =user
/ @systemAccount =system
/ @id int
.