Hi Everyone. I try to model the GCP and I use the recently updated "Google IAM in SpiceDB" schema from the playground. How can you bind the Role to a specific intance with that model. The sample shows

specific_db_admin

has elevated right on

spanner_database:db1

because the existing relation

granted->role:spanner_database_admin

. If I want to grant same access on db2 to

specific_db_admin2

I'd add

spanner_database:db2-[granted]->role:spanner_database_admin

relation and

role:spanner_database_admin-[bound_user]->user:specific_db_admin2

it permits both

specific_db_admin

and

specific_db_admin2

with elevated right on both

db1

and

db2

something is missing from the model. Did anyone solve that problem? I try do add a new

definition role_binding

that connects the resource-role-subject triplet so path from resource would be like:

spanner_database:db2-[grant]->role_binding:db2_admin_specific_db_admin2-[bound]->role:spanner_database_admin-[spanner_databaseoperations_delete]->role:spanner_database_admin-[bound]->role_binding:db2_admin_specific_db_admin2-[bound_user]->user:specific_db_admin2

Does anyone solved that problem somehow?