we offer this capability on our enterprise version of SpiceDB: https://authzed.com/docs/spicedb-dedicated/fgam