Today when a check result is conditional, the partial caveat info includes the variables that are missing values. Would it be reasonable to return the partially evaluated CEL expression?
As I understand it, CEL was designed to translate to SQL well, and so a partial CEL expression could then be mapped to a DB query on the client side, removing the need to call SpiceDB again, letting the client's DB do the remaining filtering required.
For example, there is a similar kind of idea being considered in upstream Kube around "conditional authorization," where the authorizer may conclude with a partially evaluated CEL expression, which is in turn passed down to lower layers to be enforced as part of processing the request.
I am wondering if similar could be achieved with SpiceDb. Does this makes sense? Any thoughts?