this comment is sorta exactly where my head went: https://github.com/authzed/spicedb/issues/1320#issuecomment-1561626079, sounds like we have to do it on our side