How can we have attribute based access, Like If user belongs to marketing department has access to marketing document, if belongs to finance department has access to finance document. Department is an attribute of user.