Hi there, I'm currently evaluating Cerbos, which is a great tool for 95% of my use cases. I'm using Prisma as ORM. I'm working on a ReBAC setup with the following use case: an API should return a list of all Documents filtered by predefined policies. For example, a user can access a document if they own it, or if an accepted/removed contact (affiliatedUser) created the document on their behalf. There are of course multiple conditions, but this one is representative of what I'm trying to achieve. The PDP will then always return

PlanKind.CONDITIONAL

. The biggest risk right now is mapping the SQL query to the query that returns the list of documents. 1. How to express such ReBAC policy in Cerbos without pulling the entire database records? 2. How to reduce the risk of wrongly built SQL query because some

queryPlanResult.filters

are not applied correctly to the SQL query? Is this the right way to build the PDP with Cerbos? I couldn't find a clear way to handle this in the documentation, as it mainly covers RBAC and ABAC.

model Document {
  ownerId   String
  owner                   User                 @relation(name: "DocumentOwner", fields: [owner_uid], references: [id], onDelete: Cascade)
    
  creatorId String
  creator                   User                 @relation(name: "DocumentCreator", fields: [owner_uid], references: [id], onDelete: Cascade)

  // ...
}

model User {
 id           String    @id
 contacts     Contact[]
 
 contactAffiliations          Contact[]
 // ...
}

enum ContactStatus {
  PENDING
  REFUSED
  ACCEPTED
  REMOVED
  DELETED_ACCOUNT
}

model Contact {
  id String @id
  
  ownerId                 String
  owner                   User                   @relation(name: "UserOwnsContact", fields: [ownerId], references: [id], onDelete: Cascade)
  
  affiliatedId            String
  affiliatedUser          User                   @relation(name: "UserIsAffiliatedWithContact", fields: [affiliatedId], references: [id], onDelete: Cascade)
  
  Status ContactStatus
  // ...
}