This is actually totally open for discussion. I mentioned in this thread that we've discussed having some kind of server-side component for processing policies as well. https://github.com/authzed/spicedb/issues/158