Zanzibar (and SpiceDB) has an API call Expand which resolves all of the entities with particular permission/relation. You'd then take that output and feed it into the SQL query -- a process we call "pre-filtering" because you are attempting to filter results before you ever get them from your database