Firebase permissions based on user's role -

in application supposed have three kinds of roles:

• store: can whatever kind of reads , writes on bellow owned key;

• customers: can create chat keys underneath designated store; once chat created can push message child, on own chats;

• attendants: can update chats designated them, , insert under messages tag.

the database similar to:

"$store_id": {     "owner": store_id,     "chats": {         ...         "$chat_id": {             "owner": costumer,             "attendant": attendant,             "messages": {                 "$message_id": {                     "owner": customer_id                 }             }         }         ...     } }  

i can't figure out how can achieve behavior because:

1. if permission applied top level node, children can't override it;
2. if crack database valid credentials (i.e.: customers'), can assume whatever role want;

how kind of issue managed in firebase?