to see which permission rely upon which relations, there is a forthcoming proposal: https://github.com/authzed/spicedb/issues/1505