I’m really pushing this for a SaaS app where most queries are “what can this user view/edit” or “what orgs is this user in”. It feels like anything less than SpiceDB-as-truth is just implementing the confused deputy problem. What has surprised you running/working with this in production? Things that were harder than expected or things you worried about that turned out not to matter?

The only issue we found was needing to join against metadata

That sounds manageable! Like, is it just a “WHERE id IN” query after the LookupResources call, or did you have to build caching/batching infrastructure to make it tolerable at scale?

yep and not really

i'll also chime in that we tried this at my last company for the management of IAMish groups, and what we found was that SpiceDB didn't work all that well as a general-purpose graph database, especially when we had to do manual JOIN-ish logic across sets of relationships. we ended up moving our source of truth out of spicedb and upstream to a normal postgres-backed service.