SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

group:x#member@user:a
group:x#manager@user:b

```
definition user {
 relation member_group : group
```

`member_group` needs to be written as well

`definition user {
        relation member_group: group
        permission can_be_viewed = member_group->manager
}`

you need to write the relationships for `member_group`

```        permission can_be_viewed = member_group->view_member```

`definition group {
        relation manager: user
        relation member: user
        permission view_member = manager + member
}

definition user {
        relation member_group: group
        permission can_be_viewed = member_group->view_member
}`

`relationships: |-
  group:x#member@user:a
  group:x#manager@user:b
  user:b#member_group@group:x
  user:a#member_group@group:x`

`192:~ $ zed permission lookup-resources group view_member user:b
x
192:~ $ zed permission lookup-resources group view_member user:a
x`

you're asking which groups can the user view

`192:~ $ zed permission lookup-resources user can_be_viewed user:a
b
a
192:~ $ zed permission lookup-resources user can_be_viewed user:b
a
b`

Sorry, here is the right call.  Looking at the schema, there is no special value given to the manager relation, so it makes sense.

I'm still not clear what the problem is, exactly

Given the same lookup-resources API call, I'd like user b, a group manager, to see both a and b but user a, a group member, to only see user a.  This is to "hide" user b from user a.

`192:~ $ zed permission lookup-resources user can_be_viewed user:a
192:~ $ zed permission lookup-resources user can_be_viewed user:b`
b
a

Never mind, I need to think it through more

🙂 It is hurting my brain.  I was hoping relations could do this, but  am worried this can only be achieved with an attribute?