as for dynamic decisions: that is what the caveats proposal currently being implemented will solve: https://github.com/authzed/spicedb/issues/386