I think you could use a wildcard for "type 1" users to make them all reachable for the resource... but I'm unsure from your description how type1 users are reachable from type2 users. Can you expand a bit?