Chase
03/03/2026, 12:03 AMdefinition authz/principal_types {
relation includes: orguser:* | identity/group:* | resourcemanager/organization:*
permission supported = includes
}
definition authz/role {
relation has_resourcemanager_organizations_get: authz/principal_types
relation has_resourcemanager_organizations_update: authz/principal_types
...
For every supported principal type, I'm writing a relationships like authz/principal_types:1#includes@orguser:*. I'm using this to avoid having to add a wildcard for every single has_* permission relation in my schema, and to make it possible to add a new principal type by simply adding a new includes relation and writing a new relationship. The assumption is that the includes relationships will be cached so lookup will be fast, but one concern that's been brought up is that this might result in a dispatch hotspot due to how sub problems are cached.
Is this concern accurate, and if so how concerned do I need to be? Is there any sort of adaptive spread for frequently accessed sub-problems?