if you are using an RBAC-like model in SpiceDB, you could also just use the normal Watch and just check for changes on those role relations too