This is exactly what Fine-Grained Access Management does, however, it's a paid feature. https://authzed.com/docs/spicedb-dedicated/fgam