It always strikes me as odd when people want this functionality (and
Apache is proof that they do). It seems far easier to employ such
restrictions at write/create time, or at least offline, rather than as
part of the read.
That said, if you really want this feature, it shouldn’t be too hard to
write it as a module.