Keycloak has an event subsystem. I think a few folks in community have implemented a hook that calls into SpiceDB on relevant events to update relationships. One of my old teammates wrote this one as a POC: https://github.com/DGuhr/keycloak-spicedb-eventlistener We also use Keycloak and SpiceDB, but as of now we are publishing relevant events to a general purpose message bus, and then updating based on that. Doing something synchronous, though, from within a KC transaction, would be ideal, since then there is no delay between, say, a user registering and a user getting access.