Hi mates, I'm in the very beginning of my journey with SpiceDB started modelling my org structure and have a questions about assertions and playground First of all about my case - Medical Organization, where people can request document templates for signature and sign them, different roles has access to different templates. As a first step I'm trying to solve the following case - all people in organization can view all templates, only specific roles can materialize specific templates first question about model: I looked through the demo, where organization has different roles and permissions, logically I understand how it works with specified examples but in my case seems that it does not write way

definition user {}
definition organization {
    relation admin: user
    relation doctor: user
}
definition documents/template {
    relation org: organization

    permission view = ???
    permission request = ???
}

because: 1. different roles should be configured with different templates and I have no guess, how to do that in current schema 2. it will be awesome if template won't have a strict relation with a concrete organization, because I can have many organizations and would like to share templates between them ----- this forced me to another one schema, where role is a relation, each user has relation with role and template has a relation with role also

definition role {}
definition user {
    relation role: role
}
definition documents/template {
    relation viewer: role
    relation requester: role

    permission view = viewer
    permission request = requester
}

but I stuck with assertions, I expect that assert will work through graph and I can check whether a particular user has access to template, but it fails

assertTrue:
  - documents/template:fv#request@user:rinat

but check through role works

assertTrue:
  - documents/template:fv#request@role:admin

thx a lot for your help and recommendations

those assertions don't work because the links in the graph graph doesn't go in the same direction and end in users it goes documents -> roles and users->roles, not documents->roles->users for this type thing you'd likely want a schema like this:

definition user {}

definition role {
    relation member: user
}

definition documents/template {
    relation viewer: role#member
    relation requester: role#member

    permission view = viewer
    permission request = requester
}

and then when you assign a role to a template you include the member relation:

role/admin#member@user:rinat
documents/template:fv#requester@role:admin#member  <-note the relation

then your assertion should work:

assertTrue:
  - documents/template:fv#request@user:rinat

because you're going from document -> role#member -> user

thx a lot, it works !