How do you add security context easily using tags for file access? Tags seem pretty broad, but I guess you could have an ACL that excludes access unless you ha

How do you add security context easily using tags for file access? Tags seem pretty broad, but I guess you could have an ACL that excludes access unless you have access to the tag of that application name. But you also want to ability to allow specific user/group access, so it seems like you'll have a complex interaction of tags that exclude access and allow access. I imagine there's some good prior work out there regarding this, but the complete lack of any mention of how this affects the security of the system isn't promising.