1. When relation "contains" another relation, it appears using the arrow operator on that relation doesn't work on the "contained" relation but on the "container" relation. Is that intended? 2. If I implement the above "fix" (using a permission on the "container"), the next surprise seems to be the order of expressions in an & operation changes the results of lookup resources.

they only apply to the subject itself, not to the subject + relation

when you do

somerelation->somearrow

you're asking to walk to

somearrow

for the subject of

somerelation

, directly

#2 is likely https://github.com/authzed/spicedb/pull/1226

Playground doesn't have that fix in

zed

yet

It looks related to the arrow on subrelation

If I take that out, it works

Updated playground link: https://play.authzed.com/s/4KzQD_khj_pj/schema

Opened an issue with some more detail https://github.com/authzed/spicedb/issues/1323, I hope that helps

I also opened a PR to clarify the behavior of arrows on subject relations https://github.com/authzed/docs/pull/119/files

@Alec Henninger https://github.com/authzed/spicedb/pull/1324

thanks for the repro case

I've included a variation of it (and a simpler one) in our consistency test suite for testing moving forward