a centralized authorization service like SpiceDB is typically held up as an alternative to claim-based authorization