Right. There would be a create permission that did not include read, but would allow reading topics created by the user. So a new type would get added here:
~~discourse/app/models/category_group.rb at main · discourse/discourse · GitHub
And then a whole bunch of code that refers to those types would need to get modified. Or for a plugin, maybe it would make more sense for CategoryCustomField to get added that would bypass the creation restrictions and update category and topic serializers to include the now-available topics.
Maybe you’d create a topic in a category with create permissions and after_create (or similar) the plugin would move it to a subcategory that only staff can see. And then the category serializer could be ammended to pull user-owned topics from the hidden subcategory into the category. That wouldn’t require a new category permission at all and if the plugin were removed, the topics would just be regular topics in a staff-only category. A proof-of-concept of this (without proper specs and such) might not take too long. I might poke at this later today (though I’m afraid I might have other work to do.)