definition document {
  relation tag_developers: user:*
  relation tag_qa: user:*
  relation reader: user

  permission developer_read = reader & tag_developers
  permission qa_read = reader & tag_read
}

i haven't actually tested this but i think the idea is sound