as @yetitwo mentioned, its either use caveats or use https://github.com/authzed/spicedb/issues/597 once it lands