we've actually moved our management of the user -> object relationships into an external service as well because our admin application wanted to filter/sort/paginate in a way that SpiceDB didn't support particularly well