we're doing it by fronting SpiceDB with another service, and then writing logic into that service that controls access to SpiceDB using SpiceDB