At a high level you can think of it as relationships having conditional expressions

So you can say “user foo is a viewer IF …”

Like “user foo is a viewer IF today is Friday”

the question is ... how those conditions are built?...can we build one and plug it in?

They are defined in schema and parameters are filled at check time

Using an expression language

It’s getting a bit late here, so I’m going to disconnect for the evening but if you have further questions, leave them here and I’ll be happy to answer in the morning

thx Joey, appreciate your time...one more question i have is, can we embed authzed into a go app as a decision engine the way opa can be embedded as go lib?

You can but I wouldn’t necessarily recommend doing so

It loses a bunch of the benefits

the expression language you mentioned for "caveats" - will it be a new scripting lang? or schema lang?

what kind of key benefits will be lost with the embedding approach, any ideas?

It’s googles common expression language (CEL)

You lose out on the neutrality of having your permissions system be a service, as well as the ability to break down problems into subproblems which get federated to other nodes in a cluster (in many embedded scenarios)

thx Jake, so is it right to say, we can write out custom decision function in CEL and plug it in part of authzed's decision making flow?...assuming that's kinda case, would it possible to pass/process our custom json/data into that plugin function to help the decision making?

Yea that’s the case idea. You can associate a set of attributes with either a relationship or with a request

when you say "break down problems into subproblems which get federated to other nodes in a cluster" - is it subproblem of decision making(graph travel subproblem) get federated across distributed nodes?

Correct

that would be awesome to have custom logic extension via CEL ... i will read more about CEL to get an understanding...

hmm...i always assumed the graph subproblems are solved in parallel in the same process/instance like go-process , didn't realized they get distributed across multiple nodes/machines...but for a massive scale(that u guys aiming for) it definitely makes sense...good to know the insights...

that's even make ur implementation more true to the zanzibar paper...very nice...

we have several examples of CEL-based caveats in https://github.com/authzed/spicedb/blob/052084677ceb476ff93f483a75098b762560d3fc/internal/dispatch/graph/computecheck_test.go

You can also extend the language with your own custom types and functions, but we expect that won't be necessary in most cases

@vroldanbet the samples are very helpful, i will take a look...thx

just curious on one more thing... does your schema lang related to the schema/lisp lang? i initially thought they were same ...

You’re thinking of scheme? No relation.

yes...thx Jack

You’re thinking of Jake? No relation.

🙂 butter finger, my mistake...

😂 no problem. I couldn’t help myself.