That's definitely an option and (as you say) removes the burden from the check-writer to know about what objects might need to be checked for public. I wrote it up in playground, since I thought it might be a useful example to share with anyone trying to do this before the public proposal is implemented: https://play.authzed.com/s/DybMLyaLcX4t/schema This is basically a user group, where you add every user to a default

all

group (i.e. rename "allusers" to "group" and you can make all the same checks, but now it's not a singleton type)