zw
05/29/2026, 7:29 PMdefinition restriction { // modeling restricted token auth
// when a user with oauth token makes request, the subject is the restriction object not the user
}
definition user {
relation oauth_user_read: restriction
}
definition firm {
relation member: user
permission can_view = member->oauth_user_read
}
definition asset {
relation firm: firm
relation owner: user
permission can_view = firm->can_view + owner
}
Permission check for can_view on asset is very frequent, and most of the time it's taking the latter branch (on the owner relation). We're seeing perf issues with fan out (firm#member size is large when computing firm->can_view). I tried enabling the query planner mode (since the two paths on asset can_view permission are different resource types) but that didn't resolve the issue. Wondering if you have any suggestions?yetitwo
05/29/2026, 10:26 PMyetitwo
05/29/2026, 10:27 PMzw
06/01/2026, 1:06 PMzw
06/01/2026, 4:54 PMzw
06/01/2026, 7:30 PMJoey
06/01/2026, 8:17 PMJoey
06/01/2026, 8:18 PM