document:firstdoc#viewer@user:whoever[caveat_name]

or, if you want to include context:

document:firstdoc#viewer@user:whoever[caveat_name:{"some":"context"}]

You can also load your schema and test relationships (that include caveat definitions and relationship contexts) in the playground and export a yaml file

i'm working on grokking the iam blog post + the user-defined roles blog post. are they essentially two ways of modeling the same concepts, or is there a meaningful difference between the approaches outlined in each to provisioning access to objects?

i'm struggling a bit with the "why" on defining the role as

user:*

is it because it essentially allows you to define those capabilities on the role almost as "attributes" or leaves rather than being relations to yet another definition? (e.g. a "permission" definition)

Yeah that’s basically right

In the original udr post, we were granting to a permission on a specific instance

In the google cloud one, we are mapping back to a centralized permission via a role in a context

The user:* is because that’s checking that the role has the permission, the one with the actual user is checking that the user has the role

okay, that makes sense. is another difference that in the GCP example, updating the permission on a role would change the permissions of any role_binding that uses that role, where the roles in the UDR would need to be individually touched to change their access?

Yep!

Hi team, I continue my study of the SpiceDB There was a following problem with hierarchies. I make a simple scheme with a hierarchy (groups or folders) Test data contains nesting level equal to 30 as a result, checking permissions (group:g30#member has access to group:g1) gives the error "max depth exceeded", but for (group:g25#member has access to group:g1) works. All I found is that the system has some kind of depth limit of 50. The questions are as follows 1. can I change this value via config 2. why is the value 50 and the limit is triggered by 25? 😃

the limit is

50

by default for production but

25

by default for the testing environment

we can likely increase it for testingf

https://github.com/authzed/spicedb/blob/1bc8dae609388fa6462e2dd62e2462dc427df974/pkg/development/assertions.go#L12 for reference

Thank you for your response, i will try to check and get back to you!

Hi Team, I am just evaluating SpiceDB for use at my org, and have a couple of vendor selection type questions re: support, security, contract terms, etc, is this the right forum to ask those questions or can someone DM me please? 🙏

If you’d like to ask in person, you can also schedule a meeting at https://authzed.com/contact

Otherwise, we can do a DM if you prefer

Would you mind doing a DM @Joey ? I'm based in Sydney, Aus, so would be terrible time zone cross over for ya

Will DM you

Hi Team. I was exploring authorization solutions for my company and Authzed looks like a perfect solution. Trying to do a POC and convience the team to use Authzed. I was able to design basic schema successfully. The problem is how to access it via http/grpc endpoints?. I have authzed account and created a permission system(development mode) say “abc_test1/“. what should be the base_url / server_url / target_url for the same. would be great if I could know for both grpc and http.

hi, Just read https://authzed.com/blog/acl-filtering-in-authzed/, because this is currently our biggest performance concern when it comes to scale. I feel the article ended slightly premature. It tells people how to get a list of object-ids that satisfy the query, but now you need to basically do a paginated query against your 'other' database such as

SELECT * FROM TABLE docs WHERE doc-id IN (id1, id2, ..., idn)

to list documents the given user can e.g. view with some metadata. And if the user can view 1000 docs, I doubt one can put those 1000 doc-ids into the query. I wonder what people practically do here.

Hi everyone, I'm new here. I have started with the playground and the API doc. Is there any API to retrieve the permission associated with a User?

you mean which resources a user has a permission on, or checking a specific permission for a user, or all the permissions a user has?

Thanks @Joey I am looking for an API that returns all the permission a specific user can have.

Hi @jonb1991 - looks like you’re looking for LookupResources which will get you all of the access a given user has via relationships or computed permissions. https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.PermissionsService.LookupResources

Sorry @jonb1991 - rereading your question I don’t think that’s what you’re looking for. What use-case are you solving for?

Hi, Is there a way to support multi-tenant? Can we create a database per tenant for isolation? I was not able to find an API for this?

Hi Looking at the API for resourceLookup, do we need a "permission" there? We want to retrieve a list of all resources/permissions for a given subject. is that possible?