yep

but when would you need to explicitly state that?

aside from

...

?

the above is a good example

(which you no longer do)

you want to grant a role to users within another relation

in this case, to the members of the team

not to the team itself

Aaaaahh

the "team" can't view a resource, its members can

otherwise if you said the team was a viewer, then you'd need an arrow to reach the users:

definition user {}

definition team {
  relation member: user
}

definition resource {
  relation viewer: user | team
  permission view = viewer + viewer->member
}

this works, but its not as nice

i see, thanks again Joey.

anytime 🙂

Hi - Are exception status codes are documented ?

As in the gRPC response error codes?

Like I am getting one exception with status : FAILED_PRECONDITION , using java gRPC client. I can't see its listed here : https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.ErrorReason

failed precondition is a GRPC standard error code, described here: https://grpc.github.io/grpc/core/md_doc_statuscodes.html

the ErrorReason is included in the details of the error

☝️it comes as additional error information. gRPC error code, and SpiceDB error codes are different things

Hey! Any examples of how to build something liken Google clouds IAM system on top of SpiceDB. The Zanzibar paper mentions that cloud iam is built as a layer on top. Specifically, resources (objects) are modelled as a tree. Roles can be assigned to principals on resouces and apply to all resources further down the tree. Each role is tied to a fixed set of permissions/strings (..). When performing authz you test if a principal has a given permission on a given resource (not if the principal has a role). Its seems that the resource hierarchy could be modelled in SpiceDB, but i fail to see if its possible to detach the role definition from that. All examples seem very explicit. In cloud iam roles can be created on the fly. Linked with permissions and then bound to the resource hierarcy.

we have a blog post about exactly this: https://authzed.com/blog/user-defined-roles/

Thanks, I’ll have a look!

for testing, you'd check if the user had the specific kind of access on the resource

Is the "watch" API disabled for development / free permissions systems created on https://app.authzed.com/ ? I'm getting

io.grpc.StatusRuntimeException: PERMISSION_DENIED: unknown request

when I attempt to call it (using Java client

com.authzed.api:authzed:0.3.0

)

Watch API is not currently supported on authzed.com

Good to know, thanks! So to use the Watch API, we'd need to be either self-hosted or SpiceDB Dedicated - is that correct?

at this time, yes

Example: folder:a#shown_in_any_module@module:xy folder:b#shown_in_any_module@module:xy module:xy#has_licence_for_mio@user:alice module:xy#has_licence_for_cpgo@user:bob

Ok, thanks.