Since this happens at the gRPC level with the resolver registered by

kuberesolver

, it seems to be somewhat opaque to SpiceDB?