we're in an awkward place where we're rolling in a central authorization system, so spicedb doesn't already know everything that it needs to about the objects in our system