SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

Is it possible to get the relation in combination with the lookup. In our case a person can have access to different cases, but with different relations, depending on the case.

👋 so you essentially want to know how a subject was granted a specific permission to a resource as part of a `LookupResources` call?

Exactly! So on case1 a person has access_case through admin relation and on case2 the same person has access_case through read relation.

Simple exampler of case definition

definition case {
  relation admin: person
  relation reader: persen

  permission access_case = admin + reader
}

right. This is what the `Expand` API is meant for, except it does not recurse like `LookupResources`, making it somewhat limiting. If you have a not too deep schema it may just work ™️

There is also the option to return debug information as part of `CheckPermission` API which also gives you that, so you could do a follow up check and retrieve that information

I'm not sure if `LookupResources` supports the debug symbols. <@444996680530657281> ?