Such constraints are expressed in terms of relationship types, their depths and possibly their trust levels, depending on the considered model.
One of the proposals in this regarding is setting set of rules for each resource to be protected.
Access rules represent the type, depth and trust level of the relationships must user have to authorize to access the resource.
Access control is requestor-based in that the burden of access control is mainly on the requestor side.