Maybe you could look into direction of using groups? In our system we use groups to identify HR admins. Moreower we have dedicated groups for different HR streams/regions. The main consirn here is that it requires some effort to maintain which in our...