> We generally want an all or nothing approach such as: "customer can list products", "customer can sell products", etc. > In such a case, would be it acceptable to make relations such as: > product:* list user:5555 ? You cannot use

*

as a resource name, but you could just call it

all

or whatever you prefer > In our case, we would be using Spanner. Should I be assuming that you're using time-bound reads? If so, what is the default value used? Yes, and the default window is ~5s. After that point, the cache is no longer used and a new 5s window is chosen (if

minimize_latency

is used, which is the default option). This can be overridden on a per

CheckPermission

basis by specifying a

consistency

block and option > Should the need arise, perhaps we should cache the responses on our side as well? Do you have any recommendation regarding this? In general, there isn't a reason to cache on the application side unless you need a much larger cache window > My third question is about schema updates. If I were to update the schema for whatever reason, if I don't backfill the relations, the old schema would be used. Not sure I follow. If the schema is updated, it will be used by all requests after the caches become invalid, which is ~5s as stated above > When we want to apply ACL, what should we do, exactly? Should I WriteRelations with the operation DELETE? Do you mean when you want to change it? > Do you have any guidelines or recommendations about storing them? Generally, you should store them next to the resource being checked, ideally in your database > Should I just put them in some Redis store with some TTL? 10 seconds would be acceptable? You could do that, yes It should be noted you only need to use ZedTokens if you care about the New Enemy Problem