Sorry, but I don't understand how this solves the use case. Tag is an attribute/property of a Document Object. As in I can create a new document with Id say 1 and add the value for property Tag="Developers". Now I want to allow Users in UserGroup="Dev" to be able to see Documents with Tag="Developers". To expand the use case both list of users that are able to see a bunch of documents , and the list of that bunch of documents that be shown are dependent on the attribute/properties of the respective objects. List of users is dependent on User attribute/properties and List of Documents is dependent on Document attribute/properties. A generic PBAC example could be like "show all Document objects with a property Genre="Movie" to all User objects with a property Interest = "movies".