Permission for folder assets on tag basis

Hi,

I have a requirement in which if a workflow runs on a particular private folder (having all child as dam:assets) then it creats groups with the folder name and tag name (tag name is a String [ ] property in the folder schema  ) and then it will navigate through all the child assets and one by one it will match the tag of the asset (tag of the asset is a string [ ] property in metadata schema ) with the current folder tag .

if folder tag matched with the tag applied to that asset then that asset will be allowed read permission for that group.

The problem is suppose :

Two groups created one is "folder tag 1" group and anothr is "folder tag 2"  group

so folder tag 1 group people should ony see all the assets having tag 1 applied and folder tag 2 group should only see all the assets having tag 2 applied. How to achieve that programatically.

How can i deny all the child assets and give access to only those assets having that particular tag and also i have to give permission to parent folder on which the workflow will run, because a user can't view any child if the user doesn't have read permission on that parent folder as what i observed. 

And what will be the behavior if someone comes and create one new asset in that folder (with or withot tag)?

Please guide.