Hi guys,
# zanzibar
s
Hi guys, I am trying to understand how Leopard index works from what is written in Zanzibar paper. I can't figure out, whether is works particularly for 'member' relation and nested 'groups', i.e. it flattens paths between resources of the same type, or it can be used for arbitrary relations in a deep/wide graph (i.e. it precomputes arbitrary permission checks subproblems).
I saw your comment in zanzibar paper > While not given a great detail, Leopard is known to be specialized only to nested group membership, which is often deep and also easy to compute, having no computation besides membership. So I assume, theoretically, as long as I have relation
member
(or any other name with the same sematics) it is possible to use Leopard even when different resource types are linked.
the problem I am trying to solve is the following. https://play.authzed.com/s/bWNmGRqUHTVr/schema Let's say, I have users. Each user may have one or more different keys to a global organization. Permission to access organization is computed based on the keys.
check organization:myOrg#full_access@user:1
leads to all
level_two
keys being fetched from db and then dispatched for key-user relation check. That is a known issue for wide graphs. I am trying to understand whether Leopard would possibly help here, given that no `group`/`member` are involved here
also I am a bit confused with tiger cache proposal since 1) at https://zanzibar.tech/ it is mentioned that
In SpiceDB we are planning to generalize this index as the Tiger cache, for any configured relation(s) or permission(s). Read the proposal.
2) and then in propsal you have
NOTE: These APIs, if traversing deeply nested object types, would also benefit from a Leopard cache, when we implement that.
does that mean tiger is not a leopard replacement?
j
sorry, I just noticed this thread had no response
Wide relations aren't super problematic; its the deeply recursive ones where Leopard helps