at my old company we approached it through the use of event sourcing and moving a representation of the "roles" outside of SpiceDB into their own service which was then replicated into SpiceDB