ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
SpiceDB's per-request consistency modes let you choose between speed and read-your-writes guarantees. Treat the knob as a correctness decision: minimize latency for grants, at-least-as-fresh with ZedToken for revokes, and fully consistent only when you must.
Permission granted then immediately denied in SpiceDB is often New-Enemy. This guide shows how to diagnose stale reads with ZedTokens and at_least_as_fresh_as, and when to elevate.
How to pick a SpiceDB CheckPermission consistency mode: default to minimize_latency, persist ZedTokens for read-after-write flows, and reserve fully_consistent for rare high-stakes decisions.
Learn how to capture SpiceDB zedtokens from writes and use the at_least_as_fresh consistency level to guarantee that permission checks see the latest changes, avoiding stale reads after updates.
SpiceDB utilizes ZedTokens to maintain consistency across distributed datastores, ensuring that permission checks are performed against a snapshot at least as fresh as the provided timestamp. This mechanism is critical for preventing the "New Enemy" problem where revoked permissions might otherwise be granted due to stale cached reads. When a client requests
SpiceDB's stable authzed.api.v1 API, introduced with the 1.0 release, lets each permission call carry a consistency requirement: minimize_latency , at_least_as_fresh with a ZedToken, or fully_consistent . The documentation explains the trade-offs, but it does not prescribe which requirement a client should persist for a read-after-write flow. The goal is to
After a SpiceDB deployment, some CheckPermission calls appear to return outdated results even though the relationships were written successfully. The likely suspects are the consistency level used on the read path and how zedtokens are (or are not) being propagated by clients. My understanding is that each write returns a zedtoken, and reads can request mini
spicedb