That's basically what I'm after, but can't wrap my head around what exactly that looks like. Honestly I thought I could just apply caveats to permissions which would make it trivial but I must have got my wires crossed with openfga's abac or something.