this isn't something we've toyed with, but it sounds like someone will probably have to write and run some piece of infra that connects IAP to spicedb and teaches it what permissions mean what in the right context