most of the above can be done either directly or via use of caveats: https://authzed.com/docs/reference/caveats