Query Engine Permissions

Currently, environments can be restricted to a specific set of users, but query engines associated with an environment are accessible by every user with access to the environment.

We have a use case to manage many query engines in a shared environment, but restrict each engine to specific users. For example, one environment used by 3 teams, containing 3 query engines, each assigned to a specific team. This is not related to visibility of queries/results, it's just about limiting who can use each engine.

I'm working on implementing this in a similar fashion to environments, with a new table user_query_engine. I am planning to make query engines accessible to everyone (e.g. public) if the access control user list is empty. If a user does not have access to a specific query engine, it would be hidden from the query engine selector.

Does this seem reasonable? Do you have any concerns or suggestions? Thanks!