What Escada’s suggestion implies is that adding a new value (e.g. employees) to the common ones listed for such an important tag is a bad idea. If a data consumer finds such value they will hardly know what to do and will likely fall back to a default “no”. If you really want to make the distinction then use access=private and private=employees. The odd data consumer will know that access is restricted and the more clever one or the human user can additionally evaluate the employee information.