definition repo {
  reader: user | user:*
  permission read = reader
}

and then you write

repo:foo#reader@user:user*

and then when you make a check it'll pass for any user