You probably want to avoid adding a proxy in front of SpiceDB -- even a TLS handshake from establishing a new connection is often enough to blow your performance SLAs. It's quite tricky to layer on your own logic and still maintain the 99th percentile performance requirements. I'd try to see if you can get by with using provisioning many preshared keys if possible. Maybe it makes sense to reuse them depending on the domain.