Hmm, perhaps with Discourse Policy and group permissions?
- add-users-to-group: accepts a single group as input; users who accept the policy will be automatically added into this group (when policy is manually revoked or if the policy version is updated, user(s) gets removed from group)