Assuming its just data at rest? Use gpg. Encrypt your plaintext with all of the authorized users public keys. When someone joins few crypt with the new persons

Assuming its just data at rest? Use gpg. Encrypt your plaintext with all of the authorized users public keys. When someone joins few crypt with the new persons key. When they leave rotate creds and rencrypt minus their key. Keep the cipher text in VCS so you have change history and a light audit trail. This method is very maintainable for a dozen or two users. I've never looked, but there's probably a management application built around this work flow as well.