The problem I foresee with SpiceDB here is:
1. We use a billing solution like Orb/Metronome/Lago to ingest billing events and create our billing metrics, contracts, and rules. This is the source of truth for billing and entitlements. In order to have SpiceDB handle this I'd potentially have to duplicate this logic into SpiceDB both at the schema level and face the dual-write problem to keep the systems in sync
2. I could be wrong, but I don't think SpiceDB has a way to tell with low latency if something 403's due to a entitlement check or just a higher level authorization check? This is critical as our frontends need to display different messages back to the user in each of these cases
I also have seen solutions that solve this entitlements problem specifically like stigg.io (but they seem overly expensive & I question how much they really help). Orb/Metronome/Lago have there own entitlements APIs but these systems are not meant to be on the hot path of your APIs as they have higher latencies (part of what drew me to seeing value in using SpiceDB here). Another solution is just to roll entitlements in-house and use some syncing to write the entitlements data to our primary Postgres DB
I know this is a lot. But I'm curious if you guys have had experience with users implementing entitlements in SpiceDB and how they did it. And if you think SpiceDB is the correct solution here at all. I know I'm potentially stretching SpiceDB outside of its primary purpose here
BTW I absolutely love SpiceDB. It has been a massive enabler for us as a startup. We have been able to implement some seriously complex authorization flows into our app in a seemless way that competitors that have been around for years can't figure out. We would get clowned on for saying this to someone non-technical, but SpiceDB is literally a moat for us