Yes that is apart our design, however it is not clear to us how to implement the filtering through a spicedb query. It does sound like this https://github.com/authzed/spicedb/issues/1317 would solve our problem