SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

Well if you don’t have snapshot queries you could open yourself up to the new enemy problem by reading things at various different commits. Performance should be fine for caching if you just always return the latest data even if spicedb asks for older data, assuming your database can keep up.

After talking with technical leadership we're going to take a 1-2 approach. First we're going to beef up the RDS instance and see if that shrinks down the trigger runtime to a tolerable amount.

If that doesn't work we'll use postgres' pubsub to put db updates on a kinesis stream in a trigger (with a synthesized zedtoken so NEP is avoided) and pass the updates to an API that updates SpiceDB asynchronously.

And to avoid eventual consistency issues we'll 403 if the zedtoken isn't in SpiceDB yet, and perform exponential backoff to reduce load.