With your pointers I managed to get these pesky feature flags working! The trick for me was to have a root "platform" object containing all users (which is the case in our system, really), and have the feature flag link to it. Here's a playground for it, which covers a real-life permission we have: https://play.authzed.com/s/O5MpV9iotWUc/schema. Thanks a lot for your help!