We have a base policy like "user can access all items they own" which we could do with a caveat, but the sharing is what I struggle with without having all the ids.