Using SpiceDB's Consistent Read for Up‑to‑Date Permission Checks

The Problem: Permission Checks That Miss Recent Changes

When an application updates a user’s role and immediately asks “Can this user delete the document?”, an eventually consistent read might return stale data, leading to a false denial or an unintended grant.

How SpiceDB’s Consistent Read Works

SpiceDB stores permission data as relationship tuples evaluated in a Zanzibar‑style graph. The Read API accepts a consistency parameter. Setting it to CONSISTENT forces the node to perform a read‑after‑write check against the latest committed transaction on the leader, guaranteeing that any tuple written moments before the read is reflected in the result.

Worked Example: Zed CLI

Assume a local SpiceDB instance reachable via the zed CLI with an admin token stored in $SPICE_TOKEN. The following commands write a relationship that makes user:42 an owner of document:123 and then immediately check the permission with a consistent read.

# Write the relationship
zed write --token $SPICE_TOKEN "user:42#owner@document:123"

# Consistent permission check
zed check --token $SPICE_TOKEN --consistent "user:42#owner@document:123"

Running the same check without the --consistent flag (or with --eventual) may return MISSING for a short period while the write propagates to follower nodes.

Trade‑offs and Limitations

• Consistent reads route to the leader node, adding roughly 10‑30 ms latency compared with eventually consistent reads.
• High write traffic can turn the leader into a bottleneck if many clients request strong consistency.
• During a leader election or temporary unavailability, a consistent read returns an error instead of falling back to eventual consistency.

When to Use Consistent Reads

Use them for security‑critical checks that must reflect the latest permission change—e.g., after granting or revoking access, before performing a privileged operation, or in UI flows where a stale denial would confuse the user.

For bulk reads, background jobs, or non‑critical UI elements, stick with the default eventually consistent mode to keep latency low and reduce load on the leader.

In summary, SpiceDB’s CONSISTENT flag gives you a simple, SDK‑wide way to obtain strong, up‑to‑date permission decisions when you need them, while letting you retain the performance benefits of eventual consistency elsewhere.