SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

hang the token off of the user and go through the user to the token

Something like this?:
```{
    definition randomResource {
       relation owner: user | token
       permission read = owner
    }

    definition token {
       relation user: user
    }

    definition user {}
}```

other way around, you would want to use the token as your subject, so the graph needs to terminate at the token

```{
definition document {
    /**
     * writer indicates that the user is a writer on the document.
     */
    relation writer: user#token
...
}```

Is it still possible to assign an user as writer of the document with this relation ?

Or does it necessarily have to be through a token?

Basically, is it possible to write:
```user:123 -> writer -> document:abc
token:xyz -> api_token -> user:123
token:xyz -> writer -> document:abc```

Actually, nevermind. I don't need the last relation right?

Oh, you even wrote some test relationships. Awesome! I think I get it

Maybe what I can do is have something like this actually:
```{
   relation writer: user | user#token
}```