Hey Luke, i'm grappling with IAM myself. Could you add a custom claims to the token used by the user to identify within it's division to limit the results returned by spicedb ?