Hi. New SpiceDB learner here and something caught my eye that doesn't align that maybe someone can clarify. It says here that you can't reference permissions in relationships. https://authzed.com/docs/spicedb/concepts/schema#subject-relations but in the playground you write relationships to test assertions and the documentation is referencing permissions in the relationships, not relations. https://authzed.com/docs/spicedb/modeling/developing-a-schema#assertions. For example, it shows "#view" in what appears to be a relationship assertion, but "view" is a permission in the schema it's testing. Are these playground assertions verifying permissions just using the same format as relationships but not really relationships? Thanks!

the assertion syntax is related to relation definition syntax, but they're using the

#

in slightly different ways. it's talking about this:

definition resource {
  relation viewer: user | group#view
  // ^ if "view" on "group" is a permission, that's a no-no
}

Thanks @yetitwo for taking the time to explain, but I guess I'm not totally following. I don't see a relation in their example defined in the way you exemplified it. "view" is very literally a permission it appears being used in a relationship example, which is still confusing me based on the rules of making relationships. The assertion example is referencing this object type:

definition organization {
  /** administrator indicates that the user is an admin of the org */
  relation administrator: user
 
  /** view_all_documents indicates whether a user can view all documents in the org */
  permission view_all_documents = administrator
}

/** document represents a document with access control */
definition document {
  /** docorg indicates that the organization owns this document */
  relation docorg: organization
 
  /** reader indicates that the user is a reader on the document */
  relation reader: user
 
  /** writer indicates that the user is a writer on the document */
  relation writer: user
 
  /** view indicates whether the user can view the document */
  permission view = reader + writer + docorg->view_all_documents
}

Assertions: > assertTrue: > - "document:specificdocument#view@user:someadminuser" https://authzed.com/docs/spicedb/modeling/developing-a-schema#assertions

are you asking about why the syntax for the example relationships in a validation file looks similar to the syntax for the assertions?

From what I've read, the assertions are relationships. And relationships can't reference permissions, which makes sense. But the assertions provided in other parts of the documentation appear to be referencing permissions. Which would seem to go against the rule about forming relationships?

ah, no. it's an overloading of the syntax that comes from the original zanzibar paper. you use that syntax both to represent the concrete relationships (which can only have a single hop) that you write to the datastore, but you also use it to represent the transitive relationships that may exist between a subject and an object when making a check.

I see. Thanks for that clarification. I think that's what I was trying to understand.

sure thing!