[johnpmayer]

Authorization is a good fit - express your groups and roles as facts and rules (primitives) and then queries are... queries.