when used in the next

CheckPermission

call, you're saying to SpiceDB "I need to make sure that the data used for the Check is the same that said 'badguy does not have access'"