got it. thanks!

https://authzed.com/blog/user-defined-roles/ * Every time a resource instance is introduced , we need to associate the role with the instance. * Every time we need to add or remove a permission for a role , all existing association with a resource instance this has to be modified. Is there a way around this ?

every time you introduce a resource you will have to write some kind of relationship for it to be known to SpiceDB

but you could associate it with a higher level grouping, such as a project, organization, or even a singleton like

platform

to federate permissions

so like your resources's

view

permission could be calculated as

project->resource_viewer

, then your role would only have to be associate with the project resource viewer, and that would apply to all resources under the project automatically

https://authzed.com/blog/user-defined-roles/ --> when a user has a role in the context of a group (similar to group : https://authzed.com/blog/build-you-a-google-groups/) then only they should be able to do certain action on a resource (resource associated with a group). Different user can have different role in the same group. The roles can be associated with a group is also user defined. How to approach this?

is the search bar on the docs site broken? i'm having trouble getting it to produce any results

also is there an analogous concept in SpiceDB land for the concept of user rewrites i've seen elsewhere in articles about zanzibar?

appears to be... odd

permission view = viewer + write

is a rewrite

Does Postgresql captures the metrics like how much taken to serve permission check request ?

What's best way to measure qps in spicedb , I am applying load of 25 API/ Second, how do we check what is qps ?

Postgres doesn’t but spicedb captures a histogram of response times, check the Prometheus endpoint

Qps against Postgres?

got it - that makes sense. thank you!

wrapping my head around subrelations. i see this in the docs:

definition group {
    /**
     * member can include both users and *the set of members* of other specific groups.
     */
    relation member: user | group#member
}

does that mean that a group is also a valid object of a relation, but that that group's presence on the relation will be interpreted to mean the set of members? or is it that the subrelation is also what you'd declare as the object of the relation?

yes, that's correct when you write the relationship you would specify the relation of the subject as well:

group:A#member@group:B#member

ahhh got it. that makes sense. thanks!

@Joey any luck on this ?

I believe Jake responded above ^

sorry pointed to wrong message. Asking about this : https://discord.com/channels/844600078504951838/844600078948630559/979046389923340308

Does spicedb load everything in memory like OPA or does it directly queries the databases?

It often can serve responses from cache, but ultimately it’s reading through to the datastore as the source of truth

Are there any performance benchmarks available comparing it to OPA?

Not that I know of!

They’re quite different paradigms

Okay Thanks. Could you tell me how I can install it on kubernetes?

Is there any pre-built docker image available?

There are example kube manifests here: https://github.com/authzed/spicedb/blob/main/k8s/example.yaml