Probably you know and considered that already, but still I think sometimes it may be a better aproach to this kind of problems to create specific groups, and adjust directory permissions.