the general recommendation is to have a parent organization/namespace/something, have each object have a reference to that parent container, and then add a permission on that parent so that you can grant "global" access with one additional relationship write