Feature flags toe the line on being authorization or not, so it might not always map as cleanly as you'd like. A good way to think about what should be in SpiceDB or not is whether or not another (micro)service would ever want to also check for that relationship/permission.