first, glad to hear SpiceDB is working for you! One option would be to use caveats on the specific relationships, writing in the entitlement (e.g.

max_hours: 70

) and then providing the Orb-read current total (

current_hours_used: 68.5

) in the Check request; once it crossed over, then the caveat goes false and the permission check fails - you can use the

--explain

to determine why, although we have had requests to provides reasons as part of the "standard" Check call