Well what we would store is the subject of each resource, which should be 1-1, but TBD. It doesn't seem like Zanzibar will fit our use case then. What we do now is compare the identity (JWT) to the values in the record to establish if the subject matches. I could see a policy system working there, but it wouldn't handle sharing a record with family as well.