There is nothing native to SpiceDB that cleans up orphaned relations. As you mentioned, cleaning up up all transitive relations when you remove the user from the role_binding is likely your best option.