There's a github issue for this: https://github.com/authzed/spicedb/issues/261 The ExpandPermissionTree api returns only the tree. I'm currently using some client-side code to compute the subject set from this tree. It's not performant, but it's still a lot faster than running CheckPermission requests for every subject.