I’m checking if SpiceDB caveats can be used for a PBAC case. If I have a resource - Document and say I want different access policies like 1. Users in Dev user group can read Documents with Tag “Developers” 2. Users in QA user group can read Documents with Tag “QA”. In the examples above we can assume Tag to be an attribute of a Document. I see caveats but they seem to be for more dynamic use cases where the attributes are at the Subject not on the resource.