It is in the service that calls the spicedb service (which has a light wrapper around spicedb). Will do some more digging