Hi there. Glad to join the community. I'm architect consulting for a large online b2b vendor, and I'm trying to use SpiceDB to implement our Authorization strategy. I've a hard time modelling properly many-to-many relations. Let us take an example: we sell "product". The "product" can belong to many "product_list". The "user" belongs to a "company". The "company" is linked to multiple "product_list". The "user" can only purchase "product" that belong to one of the "product_list" of his "company" So this can be modelled like definition user { my_company: company } definition company { member: user available_product_list: product_list } definition product_list { member: product } definition product { permission view = ? // logic should be: // yes if product belong to any available_product_list of the company of the user } Is there a way to solve this with such a model ? Is there a way to change the model to solve the problem ?

yeah this should be trivial: https://play.authzed.com/s/HaSOMB04XEiO

So the logic will iterate all the lists and will return true if any of the list's view permission returns true, right ?

it won't necessarily iterate over all lists, it will short-circuit the search as soon as it finds one that has it

wunderbar, thank!

in this particular example, it will depend on the number of lists a product is member of, the engine will query in batches of 100 lists. Very wide relations can be challenging. It depends on your workload - at high QPS you may be able to amortize those queries.