For anyone else stumbling across this... This seems to be what I'm looking for:

relation all: user:*
permission not_read =  all - (analyst + creator + admin)