Open to the organisation, or private
A meeting is either open to the organisation, which is how every meeting behaved before this existed and still the default, or it is private. There is no third state and no per-field matrix to configure, because the failure mode of a rich permissions system is that nobody understands what is currently set and everyone assumes it is stricter than it is. One switch, one list, and the list is visible on the meeting page to anyone who can open it.
Role groups or named people
A private meeting's audience is built from role groups, owners and admins, team leads, project leads, or from people named individually, and the two combine. Grant the leads group and the meeting follows the roster: somebody promoted into that role next semester can read it without anyone remembering to go back and add them, and somebody who steps down loses it the same way. That matters most for exactly the meetings you would restrict, which are the ones nobody revisits until a year later when the membership has completely turned over.
Attendees and the creator are always included
The audience also includes whoever created the meeting and everybody on its attendee list. Inviting someone to a meeting and then having them unable to open it is the kind of thing that quietly wastes half an hour before a review, so being invited is itself what makes the meeting yours to see. The rule that decides all of this is written once and used everywhere: it renders the picker, it filters the meeting lists so a restricted meeting is not merely hidden behind a click, it guards every change to the meeting, and the database enforces it independently. A request that goes around the interface gets nothing back.
Attendance is kept on the meeting
Who attended is kept against the meeting, so a review whose required approvers never showed up is visible as exactly that rather than as a decision everyone later assumes was properly signed off. For a team that turns over every year this is also the trail that tells next year's leads who was actually across a decision, which is the question that costs the most time to answer badly. A headcount in a spreadsheet has never once answered it.