thanks - will do

Hello, A quick query on how to enforce access to the authorization model and its relationship check. Assuming I have a centralized Authorization Engine using SpiceDB. The said system can host multiple schema definitions which can be prefixed with "Globally unique Slug" for e.g definition organization_a/document { relation writer: authzsystem/user relation reader: authzsystem/user permission edit = writer permission view = reader + edit } definition organization_a/user { } organization_a/document:firstdoc#reader@organization_a/user:fred definition organization_b/document { relation writer: authzsystem/user permission edit = writer } definition organization_b/user { } organization_b/document:firstdoc#writer@organization_b/user:fred How to support the requirement where a given Organization (with its namespace/key organization_a/b) can only access their respective namespace data and its relationship checks via SpiceDB HTTP API ? Does API provide a way to connect to single instance of SpiceDB with a key that is specific to each namespace? This is basically to ensure provisioned data in SpiceDB is isolated and protected Do I need to spawn multiple instances of SpiceDB with a preshared key specific to each organization?

SpiceDB doesn't provide a means of logically enforcing that isolation

it only has a single key

Authzed Enterprise provides that capability

Hi All, I was hoping you could help me understand why this assertion isn't passing: https://play.authzed.com/s/L0eQkDFzUuFH/schema

@User the key is a different uuid

Would that be included with on-prem deployments?

yes

Hello, A quick question. I want to allow access to a resource iff the subject satisfies multiple conditions. Say user ‘Alice’ is a member of group ‘Staff’ and is using two devices - one belongs to group ‘Corp’ and the other belongs to group ‘Personal’. I want to express a condition that allows all staff to access an application ‘Foo’ only if they are doing so using their corporate device. How can I express this permission?

The only way to do that in native Zanzibar with a single check is to make your subjects a combination of your principal and their device, and build the proper relationships to match

We are gauging interest on an extension called caveats relationships: https://github.com/authzed/spicedb/issues/386

If you think this is a good fit for your use case, please leave a comment to that effect

Is there any way to define and apply in a single check that a user is allowed to establish a relation between two types, iff that user is like the editor of either instance of those types?

I'm having trouble visualizing what you're trying to accomplish in the abstract, but you're probably looking for the intersection operator

&

https://docs.authzed.com/reference/schema-lang#-intersection

It indeed feels like somewhere an & should be involved. The establish a relation must be interpreted as an action of the application. So, assume two types A and B and assume editor relations for A and B and a user who can be editor for both. The user should only be allowed to establish a relation in the application (or do anything else with A and B instances in the application for that matter) iff the user is editor for both the instance of A and for the instance of B. Is this any clearer?

so like A is document, and B is folder, and the user can only add a document to a folder if they're an editor of both, is that right?

Seems like a good example, yes.

the only way to do that in native zanzibar with one check would be to have a pre-existing relationship between the candidate folder and the candidate document, then you could use the intersection path to check (pseudocode)

document_in_folder#can_move_to = document->editor & folder->editor

you could also do two checks, and evaluate them at the same snapshot (pseudocode):

evaluation_time, is_allowed = check("document:123", "editor", "user:1")
_, is_allowed = check("folder:456", "editor", "user:1", consistency("snapshot", evaluation_time))

finally, we're considering an operation type for the proposed caveated relationships (https://github.com/authzed/spicedb/issues/386) that would allow you to make a relationship's existence depend on the results of another check request

I've seen that. Didn't quite get that my request could be an example of that. Thanks!

Handling the example in two checks is kind of trivial. Thanks. I need to see if I can get the pre-existing relation solution to work. Thanks a lot!

Why are two checks not ok?

2 checks would be two round trips to spiceDB right?

yes, but if you didn't need them to use the same snapshot you could do them in parallel

Cool. And I realize that creating a pre-existing relation also means a (writing) round trip. So no gains there.

right

writes are MUCH slower in fact

yup