Maybe if you put a data field on the thing, list of UIDs of users that have access, buts it just list of text, not users. Then privacy rule is things list of text, contains current users UID.
This is a secondary privacy rule, not the main one, as you don’t want to store the list text indefinitely.