I don't think true isolation is the need of the hour at this point. We would really like to be able to share resources etc.

if you intend to share resources, then options 1 or 2 are the way to go

it really depends on whether you anticipate the schemas being different or "merely" the data

if the permissions used by all tenants are basically the same, option 1 is the way to go

I think schemas will diverge typically when we add new features that need to be rolled in some phased fashion across our tenants. But eventually I expect them to all catch up. Not sure how tricky schema change management will be under option 1

really depends on how those new features change your permissions

if they are "merely" additive, you can use the same schema, and just not write the relationship(s) to enable the new features for certain tenants

yeah, a bit difficult to anticipate that at this point. Which is why I was thinking of going with option 2 for now. However, I then realized that all schema definitions have to be overwritten each time we want to make a change or add a new tenant

Is there a plan to make schema change management more granular (per schema prefix basis for e.g.)

yes, that's the open question we're debating now

whether that will be API-side, or tooling side

I notice that the authzed service enforces a prefix based schema. How do you manage that at the moment

we have a custom binary running over SpiceDB

its a feature of Authzed Enterprise

but those are fully isolated

which, based on your description above, seems too strict for your use case?

fully isolated meaning, you run an independent cluster for each of your tenants?

logically isolated

Authzed Dedicated, on the other hand, provides for easy independent clusters

yeah, we don't need independent clusters.

sounds like prefixing might be the way to go, if you anticipate having distinct schemas for each tenant

for now, you could store each tenant-specific-schema, and then just collect them all before updating SpiceDB

longer term, as I said, we'll either provide support via tooling or via the API itself to make this easier

yeah I think that's a reasonable step forward. Can you explain what the request to add multi-tenancy to spicedb is about? Is it the same as the tooling/API work you are referring above?

I believe that is more around isolation

ok ..

I'd like to set up a call to talk to you folks about a few other things. How do I go about doing it.

grab a spot on the calendly

is there a way to suppress healthcheck traces from otel output?