Where can I find the documentation for this? Feels like something we definitely should be doing 😅

it depends highly on your env and how you're running SpiceDB

usually done at the ingress layer

We'll need to work our way through Google's docs then around their infrastructure, but gives us a starting point, thanks!

Final question's around limits we need to consider, e.g. should we worry if our dataset grows from say 250 million records to 4 billion, given we're using Postgres?

theoretically it could become a problem at some point, but I'm hopeful the above GC and other index improvements will push that outward

long, long term you might want to consider something like CRDB

Alright awesome, thanks for the help, fingers crossed 😄

Does spicedb do its own postgres connection pooling? We're trying to setup pgbouncer and the only way we could get spicedb to work with it was to set it to session pooling. which isn't much better than not pooling

I'm trying to understand what's been working well for others when you have a permissions system with Users and Organizations/Groups. Do people tend to treat SpiceDB as the "source of truth" for which users belong to which organization(s) or do they duplicate this data and only rely on SpiceDB for the permissions/authorization piece? For example, imagine that you have a page to manage organization users. Do people tend to ignore their own database and instead store all of this information in SpiceDB? (This becomes more complex as you consider things like metadata and audit trails, of course)

we have most all of our user / org data in mongo. so what we've been trying to do is use mongo records for end user CRUD data and translate that into spicedb relations. Then applications do the checks internally. It makes it easier for end users to interact with data that is a bit more user friendly, and it also gives us a layer of anit-corruption where, if we really had to we could use our mongo docs to rebuild the permissions database.

We're not sure if this is good or bad yet- its just what we have done

haha thanks for the input! I was considering pushing for something along those lines but ... the trade-offs aren't obvious. There's additional complexity between syncing. On the other hand, its a little easier to separate concerns. And the anti-corruption isn't a terrible thing as most of us have nil experience with SpiceDB upgrades or troubleshooting disaster scenarios

we're doing just the former. we replicate into spicedb from the other services where entities are held, and we really only use SpiceDB for authorization ("who can access what") questions

you can also do a mix: you might sync some data but keep other relationships purely in spicedb (i.e. maybe sync what groups exist, but only model groups-of-groups via spicedb)

Hi there, quick question about managing relationships. We're self-hosting spicedb and still in the initial system set-up phase, so there's some churn and "burn it all to start fresh" cycles going on. It's pretty simple to do that sort of thing with the schema since writing a new schema replaces the existing one, but I couldn't figure out a way to delete all existing relationships and start over (ideally without having to destroy the datastore). The

zed

tool has

relationship bulk-delete

but you still need a resource type as far as I can tell. It's obviously not too onerous to run that command once for each resource type in the schema, but I was wondering if there was a simpler way to achieve the same result? Thanks in advance!

You could modify this function to suit your needs. https://github.com/authzed/zed/blob/417eacb40843884960fc13386c70b30a64104280/internal/commands/relationship.go#L90

Thanks for the reply! So there isn't anything out-of-the-box? What about some sort of direct manipulation of the datastore (we use Postgres), would it make sense to do something like truncate

authzed.relation_tuple

or is that just asking for trouble?

You could just drop the database and remigrate to empty

However, only do that if this is not intended as a long term solution

Hello. I wonder if Authzed can provide some hints to generate authorized sql queries? I know, I can get from Authzed list of ids of authorized resources, but that list can be too huge in some cases.

I apologize in advanced for the basic question, as I'm sure it's documented somewhere, but I can't seem to locate it. What are the naming limitations on object ID and subject IDs? Max length, valid chars, etc.?

sorry, object ID is two lines later (edited link)

Perfect, thanks!

Is anyone else attending Gartner IAM summit next week?

Is there a way to specify a region when using cockroachdb as the data store to implement something like this? https://www.cockroachlabs.com/docs/stable/data-domiciling.html

First time I read about ReBAC, I thought it allows to define any graph and specify access control on top of it. But for now it looks like ReBAC allows only one relation type — parent/child. Thus it's only trees. Is it correct? Don't you think, that a better name for ReBAC would be hierarchy-based access control (HBAC)?

Question about zookies and consistency - what’s the practical risk of not using zookies at all? My understanding is that if no zookie is provided with a check request then cached relation data will be used if available - does that mean that, for an object that was just created, there’s a high likelihood that a check will fail? Consider this use case - I post to my feed and should be able to see it immediately on my feed. Do I need to use zookies to ensure this flow works?

we have a schema that tries to do permission inheritance