one of my gut reactions would be to enforce those invariants in the app db and then sync things into spicedb (understanding that syncing is nontrivial)