We experimented with implementing multi-tenancy (i.e. filtering by something like an org within the same SpiceDB instance) using caveats. It worked but affected the performance a lot. Fetching all resources from SpiceDB and then filtering them down to one organization in the app turned out to be much more efficient in our case, but we're also very much interested in doing this with SpiceDB.