you could also pass the max at check time too, but that's your call

Would you say this is generally the case for all Zanzibar-inspired products?

I was fearing this. This is similar when you use both a NoSql solution together with a RDBMS.

its true of any relationship-based access control; what, exactly, are you hoping to do?

I’m trying to model my existing RBAC system in SpiceDB

However we have an added dimension called environment. Meaning resources can be dev, qa or prod

usually you can handle that by defining an

environment

object type, adding that as a

relation

on each resource, and then having that be walked to provide additional permissions (or remove some)

Furthermore resources have a variety of properties. These properties are used during Authz checks

But we have millions…

so ABAC-like properties?

millions of environments?

Hybrid of rbac and abac I’ll say

millions of relationships is fine

Millions of resources and properties

if you're doing ABAC-like stuff, you'll likely want to use our new experimental caveats

this was explicitly designed to handle ABAC-like designs on top of the relationship-based permissions

they allow for expressions to be defined such that a relationship only exists if the expression evaluates to

true

so you could, for example, say that a user is a

viewer

of a resource, but only if they are accessing it from the

dev

environment

@bigzofsg if you'd like, we can schedule a call to go over your permission system design in a more synchronous way. you can grab a slot at https://authzed.com/contact

It’s a bit tricky to engage a vendor in my firm. Currently I’m just evaluating a bunch of different modern policy decisions points/policy enforcement points and presenting it to my team.

gotcha. happy to continue answering questions here too 🙂

I really appreciate the support!

I never thought much of communities in discord until this one.

we're certainly trying to make it as welcoming and informative as possible

suggestions on how to improve are, of course, welcome

I'm upgrading to v1.14 on Postgres:

migrate add-xid-constraints

failed because it's running for over 1h. I don't think it's a problem for me, I can just rerun it, but thought I'd flag it as I'm not sure what would have happened if I was using the operator that manages the migration itself!

Hello everyone, I was hoping if someone can help me with zed client connection to spicedb. I have istalled the spicedb-operator in our openshift cluster and was following the example here https://github.com/authzed/spicedb-operator/tree/main/examples/cockroachdb-tls-ingress to setup the spicedb cluster. The installation got successful, i don't see any errors in the logs, but I can't connect to it using the zed client, i was just trying to set a context using the command

zed context set local example:50051 'key

Its giving me error, can't validate the cert, i have used --insecure and --no-check-ca

what drives the types for caveats (like

ipaddress

here)? Is it using a standard library?