SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

related to the audit conversation: is there a way to look at two responses from (say) two WriteRelationships calls and determine the order in which they were applied to SpiceDB?

short of reverse-engineering the ZedToken to understand the revision number

nope and reverse engineering the ZedToken to do so will inevitably break, as we reserve the right to change that format whenever we like

you could, on the other hand, use a Watch

yeah, this is for putting together a proposal for why Watch will eventually be the way to go

is there any way to understand from the Watch API when a particular change was applied to SpiceDB? (specifically a timestamp of a particular change being applied)

or is some time window around when a stream response is received the best we currently get?

additionally, looking at `changes_through`, does that imply that you'll receive a watch event for every revision bump, or is it only a guarantee that you'll have received all of the events up to that revision (i.e. batching is possible)?

you'll get a watch event for basically every transaction committed, but that's also an impl detail

may be different based on the datastore type

okay. so having received a watch event, i'll know that that change is live by that time, but i won't know how far in the past it was applied.