the current best practice is to either pre-filter or post-filter: in a pre-filter scenario, you'd run LookupResources to receive the list of objects the user has access to, pass those IDs to your search index for filtering, and return results. in the post-filter scenario, you'd run your filter on the search index, and then issue checks for the results against the user before displaying. which you use depends on how many results you expect to get from each side. longer term, the work we're doing for Tiger cache should address this problem more directly. see https://github.com/authzed/spicedb/issues/280 and https://github.com/authzed/spicedb/issues/207