SpiceDB behaves exactly per its documented guarantees, so this is a documentation request, not a bug report. When SpiceDB is composed with a separate OAuth 2.0 delegation layer (a common pattern), revoking a credential at the OAuth layer does not affect a SpiceDB permission check for a subject whose relationship still exists in the graph. Operators composing the two layers can wrongly assume OAuth revocation "turns off" downstream ReBAC access. Would a short note in the docs (e.g., in the consistency / access-control-composition guidance) help set that expectation? Details and a reproducible measurement are in a paper we can link.
SpiceDB behaves exactly per its documented guarantees, so this is a documentation request, not a bug report. When SpiceDB is composed with a separate OAuth 2.0 delegation layer (a common pattern), revoking a credential at the OAuth layer does not affect a SpiceDB permission check for a subject whose relationship still exists in the graph. Operators composing the two layers can wrongly assume OAuth revocation "turns off" downstream ReBAC access. Would a short note in the docs (e.g., in the consistency / access-control-composition guidance) help set that expectation? Details and a reproducible measurement are in a paper we can link.