hey there 👋 I'm experimenting with the "Google IAM in SpiceDB" example and wonder if there is a pattern where you can express a "this role has a grant on all entities of that type"?

You typically want to handle that at the level of the parent of the "entity of that type". In the GCP example (https://play.authzed.com/s/pNIDdxdKKOMG/schema) you have

project

and

spanner_instance

. right now there is a

granted

at the

project

level that means that they will have permission on everything below that project level. If you want to constraint that to a specific type, then you can add another relation to definition

project

like, say,

relation spanner_instance_manager: role_binding

, and add it to only the permissions that relate to the definition

spanner_instance

.

so, its not possible to grant a user to e.g. "all documents" ?

You can, just not with a wildcard. You need an entity that had relations to "all documents", and then a relation that connects with that user

how would that look as a model + data?

I tried to convey that in my initial comment. Are you looking for an actual example?

sorry, but after several tries I'm still too confused how to modelize such. lets say I'd like to grant a user 'can_read' permission on 'all documents', so that I can check for that permission like

document:x#can_read@user:admin

(which should always be true for any document id)

this is how it works: https://play.authzed.com/s/Ki4KLHM4u5CQ

okay thanks, thats kind of obvious