there are a number of ways to accomplish this, the most direct one would probably be allowing for

users:*

to be bound to a reader relation