which one you use is going to depend on whether the set of accessible (spicedb) IDs is appreciably larger than the set of filtered IDs (postgres) or vice versa