if you want to introduce a notion of roles, i'd recommend reading https://authzed.com/blog/user-defined-roles and https://authzed.com/blog/google-cloud-iam-modeling