SpiceDB v0.15 introduces stricter validation for undefined caveats in relationship tuples
0 reputation · 20 Aug 2020, 13:04 UTC
The goal is to decide how to handle existing relationship tuples that reference caveats not defined in the schema after upgrading to SpiceDB v0.15, where such tuples are now rejected at write time.
Operators must avoid runtime CheckPermission errors caused by the new INVALID_ARGUMENT response, while also considering the effort required to clean up or migrate data before a rolling upgrade.
Uncertainty remains around whether a compatibility mode should be offered to preserve the v0.14 behavior (treating undefined caveats as false) during the transition period, and if so, how it should be configured and what impact it would have on data integrity and future schema evolution.
- Should SpiceDB introduce a compatibility mode flag to revert to the v0.14 validation behavior for undefined caveats?
- If added, how should the flag be scoped (global, per‑namespace, or per‑tuple) and what are the implications for existing tuples and future writes?
- What migration guidance should be provided for administrators who cannot purge invalid tuples before upgrading?