Yes, you can define sub-roles (role hierarchies) using Ory Permissions. This is typically achieved by modeling roles as groups and then using relationships and permission rules to express inheritance between roles. For example, in a hierarchical role-based access control (HRBAC) model, you can have roles such as

admin

,

finance

,

marketing

, and

community

, where the

admin

role inherits all privileges from the other roles. This reduces duplication and management complexity. Ory Permissions allows you to express these relationships and inheritance using its relationship model and the Ory Permission Language (OPL). You can define that members of the

admin

group have all the permissions of the

finance

,

marketing

, and

community

groups by configuring the appropriate relationships and permission rules in your model. This approach is described in the Ory RBAC guide, which explains how to implement both flat and hierarchical roles using Ory's features [Role Based Access Control (RBAC)](https://www.ory.sh/docs/keto/guides/rbac). In summary, sub-roles (or role hierarchies) are supported and can be defined using Ory's relationship and permissions features.