the SpiceDB Schema (docs here: https://docs.authzed.com/reference/schema-lang) defines how permissions are computed, including rewrites (we express them as "arrows")