with the above schema, you'd write

document:1@tag_developers#user:*
document:1@reader#user:my_user

it doesn't contain a concept of user groups - you'd have to elaborate on the schema for that

Thank you. Maybe I do not understand it that well yet. I'll read through those two docs and come back. I'm hoping the user-defined roles lets role-creator create a group of users based on properties of user object and lump them in a group called role