Hi folks. I could use some assistance with a new policy we're trying to model in our spicedb schema. We model `job`s in our system, and we'd like to update our model so editing a

job

requires that the user be a manager of EVERY worker on the job.

definition user {}

definition worker {
    relation manager: user
    permission manage = manager
}

definition job {
    relation viewer: user
    relation worker: worker
    permission edit = viewer & worker->manage // our problem: this only verifies that they can manage at least ONE of the workers, but we would like a way to check that they manage ALL the workers on the job
}

To complicate matters further, we'd also like the user to be able to

edit

a

job

if there are NO workers currently on the job. I don't see any obvious or hacky ways to accomplish either of these goals solely in the schema. Ideally, I'd like to avoid implementing this policy in application code. Does anyone have any suggestions on how to achieve this or are we just out of luck? Thanks.

We have a proposal to implement the feature you're looking for (we call it "intersection arrows"): https://github.com/authzed/spicedb/issues/597 Feel free to weigh in if you have opinions on the proposed solution. How many workers do you expect to have? it could be reasonable to issue a

Check

for each in parallel in the meantime.

Thanks for the feedback @ecordell. I'll chime in on the GitHub issue.