After additional conversation, it seems reasonable to introduce additional objects such as teams or groups. this will allow more granular control over access, but retain the old way of directly assigning users.