ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Learn how SpiceDB uses Zookies (consistency tokens) to solve the 'New-Enemy Problem' and ensure causal consistency in distributed relationship-based access control.
Decouple authorization from your code using Ory Keto's relation-based access control (ReBAC). Learn how to use relation tuples and the Check API to manage fine-grained permissions.
SpiceDB’s Zookies are the safety net that guarantees causal consistency in a distributed ReBAC system. Learn how to use them to prevent New‑Enemy attacks, with a concrete schema example, write‑and‑check workflow, and best‑practice checklist.
CheckPermission answers one question: does this subject have this permission on this resource? A worked schema, tuple writes, the rewrite-tree mechanism, and the mistakes that produce wrong answers.
Learn how to design recursive tuple schemas in SpiceDB, test inheritance with the spdb CLI, and evaluate latency trade‑offs for production.
Stop making hundreds of CheckPermission calls. Learn how to use SpiceDB's LookupResources to efficiently retrieve all resources a user can access in a single, paginated request.
Learn how to eliminate the 'New Enemy' problem in SpiceDB by implementing zookies to ensure causal consistency between authorization writes and reads.
SpiceDB utilizes ZedTokens to maintain consistency across distributed datastores, ensuring that permission checks are performed against a snapshot at least as fresh as the provided timestamp. This mechanism is critical for preventing the "New Enemy" problem where revoked permissions might otherwise be granted due to stale cached reads. When a client requests
The goal is to upgrade a small SpiceDB‑backed application’s permission logic without taking the service offline. SpiceDB’s schema is relationship‑centric; changing it can affect how existing tuples are interpreted. Two documented migration paths exist: adding new relationship types (schema versioning) and altering existing types (tuple migration). Both requi
spicedb
ory