You are thinking about this correctly. We have an open issue to allow for checks against a user's self without writing a relationship: https://github.com/authzed/spicedb/issues/338