we've got this proposal and the beginnings of an implementation for making this problem easier: https://github.com/authzed/spicedb/issues/207