Measuring ListRoles Latency Under Concurrency and Unresolved Policy Precedence

Spicedb’s ListRoles gRPC endpoint is a core component whose response time directly impacts system throughput.

The objective is to quantify the latency of this endpoint when handled with high concurrency, using the default page size, to determine whether pagination or caching is required before any policy evaluation optimizations.

Logs consistently report the exact string “error: permission denied” when an unauthorized read occurs, confirming the documented failure condition. Because Spicedb does not define deterministic precedence for overlapping allow and deny statements across multiple role assignments to the same subject, the observed nondeterministic policy evaluation remains an open design question. Which specific metrics should be captured to reliably assess the bottleneck? How does the lack of defined policy precedence affect correctness guarantees? What is the impact of varying concurrency levels on the measured latency?