beyond the SpiceDB options, I imagine it wouldn't be too difficult to write a very, very simple shadow of a ReBAC system, but it would likely become unmanageable in the long term