Guys, in a well-architected SpiceDB setup my understanding is there would be two types of data: a) the main model, an authzed language structure that defines that main ownership/access permission relations and their basic structure; this part could be held in a git repo and would be updated rarely in the lifecycle of an application, as my application's needs change; b) the dynamic ownership data, with transient documents, transient permissions and other mostly-shortlived objects, this would be updated frequently by an app's UI via the API; I still thinking correct or am I totally in the dark here? If so: is there any difference between these two types of data from the point of view of the backend? If so, how are they separated and how do I, say, update the "static" model while retaining the transient/dynamic API-generated tuples (or triples)? Sorry, I'm totally clueless here at this stage and I need to deliver a model and an model update/deployment method for my app. 🙂

I think you're on the right track. It's not uncommon to keep the spicedb schema + a set of "default" relationships in git, and then CD that to your prod environment. When you deploy, it's a

WriteSchema

call to sync the schema + a

WriteRelationships

call with

TOUCH

updates to ensure the base relationships are there. And then when the application dynamically reads/writes relationships at runtime, you know that the base relationships are available and will be included in permission computations. From spicedb's perspective there's no difference between the relationships that your CD pipeline writes and the relationships that your application writes, though we do have a proposal for "static" relationships that could be defined directly in the schema: https://github.com/authzed/spicedb/issues/1266

Great, thank you!