Data sources and sinks dependent on user authorization and app policys

I have an application which needs to store different objects in different data stores based on the user's authorization credentials. I.E. the user may need to save object 1 to their BI postgres database, object 2 goes to their S3 bucket, and object 3 goes somewhere else.

Inversely, they may want to read data from different datastores based on these credentials as well. I.E records from the union of a few databases contingent on some predicate "get all rows in db1 and db2 such that the rows in db2 aren't in db3" (I invision a case where client 2 blocks client 3 from accessing records based on a column value and also has the ability to whitelist access to shared data).

I'm wondering if anyone knows a good approach or design for this type of use case