or you could put the amount into context as well

that's awesome

let's say you have a subject

user

. You want to provide a UX for admin `user`s to create custom roles and assign them to other `user`s. This would be some API that the admin user calls which eventually calls the Authzed service to update the schema. Is this common or am I missing something? Looks like the

SchemaService.WriteSchema

overwrites the existing schema. There's no way to incrementally add new portions of the schema, is there?

you'd typically model custom roles using data, not schema

I see. Thank you for pointing me in the right direction!

Thanks @_deirdre_ , The "http://localhost:8443/v1/permissions/resources" API basically checks if a particular user has a "specific permission" on a resource. For example { "consistency": { "minimizeLatency": true }, "resourceObjectType": "doc", "permission": "doc_view_permission", "subject": { "object": { "objectType": "user", "objectId": "jon" } } } But, I am looking for a solution that give me all the permission user "jon" has with resource "doc" for example, view/edit etc

the recommendation today is to issue checks in parallel for the possible permissions

we will likely add a batch check API to make this easier in the future, although it should be nearly as performant to just issue the checks in parallel yourself: https://github.com/authzed/spicedb/issues/621

Jake also recently released another blog post around custom roles with GCP IAM as example: https://authzed.com/blog/google-cloud-iam-modeling/

Hey there, could someone help me with a modelling/query question? I have created a model, relationships and checks in the playground: https://play.authzed.com/s/aHaDwQZnO42n/schema . I have a time_events object for which I can get all users which are allowed to e.g. edit, view,.. But how can I model a permission where I can get all time_events for which my user has e.g. view or edit rights? E.g. my user can be a manager and I want to get all time events for my direct reports for which I am allowed to edit. I do not find a suitable way, maybe I am only stuck and you can help me to come to the right solution? 🙂

Hey 👋 question about the API client usage in go - we have the following call to

LookupResources

here: https://github.com/RedHatInsights/authz-experiments/blob/main/engine_eval/zanzibar/authzed/attributefilterdemo/src/main.go#L71-L90 we're trying to get those resources and put them into a slice. The only way we found so-far is in line 81-90 but this looks a bit strange. Is there another, more idiomatic way? If not, can you tell us more about the reason this is how it is?

Hey Team, this is Xu from included health. I am trying to find a solution for my company regarding access control. I found SpiceDB online and want to understand more about how to deploy SpiceDB in AWS with PSQL as the datastore

hi there. we can help you here if you have questions, or you can schedule some time to chat with us directly at https://authzed.com/contact

the recommended way to deploy is to use the operator https://github.com/authzed/spicedb-operator and RDS for Postgres

we also have a dedicated offering if you want us to handle deploying and running it on your behalf

Thanks @Joey Let me have a check on the operator. For now I am considering adopt open source project

This is the community for the SpiceDB open source project, right?

yep

cool. Thanks!

I also find some other open source projects, like OpenFGA by Auth0, Ory Keto by Ory. Is there any existing comparison between SpiceDB and other open source projects?

none that isn't unbiased, but I can give you a high level comparison if you're curious (keeping in mind that I am, of course, biased)

Yeah, that will be great!

so at a high level: Ory Keto and OpenFGA both make certain compromises on the underlying Zanzibar concept in the name of simplicity or efficiency. For example, OpenFGA has chosen not to support the concept of a "Zookie" (ZedToken in SpiceDB parlance), which means that they can't easily solve the New Enemy problem. With SpiceDB, we try very hard to remain faithful to the Zanzibar paper's described capabilities whenever possible. Furthermore, SpiceDB has introduced a number of novel concepts (such as well-typed schema, LookupResources, caveats) that those solutions do not yet provide (caveats) or have adopted after we have introduced them

thanks Joey! I read docs of OpenFGA and SpiceDB. I like the SpiceDB way of defining schema more

glad to hear! we were actually the first solution with a well-typed and readable schema, so happy to hear you like it 🙂

sick! thank you ❤️

just curious, do those other solutions have a way to implement conditions/ABAC? If not, seems like Caveats are going to be a really big differentiator

AFAIK Keto does not currently. OpenFGA you can sort of "hack" it via specifying run-time relationships, but the calling application would still need to do the ABAC-like computation to produce the relationship(s)