I am a bit unsure, is SpiceDb meant to lookup the relations, or only return the permission definitions. I am asking because my co worker, says SpiceDb is not meant lookup the actual relation between subject and resource.

I'm not sure what you mean with "lookup" here. If what you mean is whether SpiceDB allows you to read relationships back, then yes, there is an API for this:

ReadRelationships

. Generally, you have full support for CRUD operations over relations, and

ReadRelationships

specifically has a filter argument that allows querying for specific relationships.

Would I be able to get the same results, as I get from the expected relations in playground. If yes, then I can use SpiceDb to tell exactly what resources a subject can access.

Yes; I use the playground as a development testbed for all my stuff and it's accurate to what I see from SpiceDB regularly.

Thanks a lot 🙂

Of the zanzibar-esque permissioning systems, SDB is the best one in my opinion.

Sorry for my in experience, but is SDB

SpiceDB

Ahhhh 😄

I looked at all the other options such as Ory Keto, etc prior to SpiceDB and Spice seemed to be the only one that did everything that I needed it to do - but the learning curve was a bit steep initially (this was about a year ago now) - it's definitely changed since then.

@CasperT everything you can do in the authzed playground you can do with SpiceDB. If you are using it, your browser is in fact running a WASM version of SpiceDB, so it's the real deal 😃

So the intended use of spicedb is to actually expand the permission tree, to get the precise access to resources, based on relation and permissions?

I don't think you can say "the intended use of spicedb" is that. It's one of the many exposed APIs SpiceDB has. I think the most used API is

PermissionCheck

, which answers "does this user have this permission over this resource"?

@CasperT the questions you can generally answer: - does X subject have Y permission on Z item (CheckPermission) - which subjects (ie: users) have a certain permission over a certain resource (ie: 'post') - which resources of a particular type that a certain subject has a particular permission over (I use this to populate 'IN' statements for SQL queries, as one example) - list all relationships on a particular object (note: not 'permissions'; but 'relations' - permissions are computed and relations are stored) amongst many other things. Those are my top 4 use cases