> when requesting software, we don't know which project it is being requested via Maybe this something I'm misunderstanding. If even you don't know which project it's requested via, how could spicedb possibly know? Based on your earlier point here: > This would not necessarily mean the user cannot use some software, only that it is forbidden via that project. the project is crucial determining access, otherwise the answer is "it depends on the project", no?