yes, this is correct (although we use Resource instead of Object, since both Resources and Subjects are considered Objects). Expand tree actually does come from the Zanzibar paper: https://zanzibar.tech/2Frf1K03Zq:0.OfIeFxeN1:1W In terms of getting the available permissions, we have an issue for this: https://github.com/authzed/spicedb/issues/613