Are there any best practices/recommendations when modeling 'triples'? e.g. I have users, objects and domains, and access is managed at the level of user-object-domain triples: users, objects and domains have their own unique identifiers. For now I've been modeling it by creating a synthetic

object-domain

definition and forcing clients to merge the two identifiers themselves at query time, as it seemed easier to manage than e.g. trying to add the domain as a caveat, but I wonder if there is a better alternative that I'm missing?

i'm not entirely sure that it's analogous, but the [google cloud iamish](https://play.authzed.com/s/MExHwQKtDx8W) schema structure might be helpful - access is granted if you have a role binding that is connected to a role that grants a permission and to an object