New Policy model to grant per-object permissions to non-team members