Originally I was going to create and remove specific objects based on relational metadata, (e.g. a "deleted" user (boolean flag) gets removed from spicedb) but that creates a lot of sync work that I later realized could be delegated to the permission engine.