Hi all I’ve got a question on what I imagine is a common use case: how to efficiently filter result sets from existing data sources using Keto For example, say: • I have a database containing text documents, and I’m using Keto to store document/user permissions • Both data sets could be large When a user conducts a search, I could: • Search across the document database for the given matching set, then iterate through that set, checking with Keto document by document if the user has access to produce the filtered set • Or do it the other way around, ask Keto for the list of all documents a user has access to, then apply that filter to a database query along with the user requested search But given that result sets returned from Keto and the document search could be large, the cross-service filtering looks like it’ll have performance issues either way Are there any best practise / standard approaches with Keto covering this case?

This is the same issue that I’m wrestling with for a design. It feels to me like “the main issue” with a permission microservice…

Yes, I’d been thinking on some form of domain specific denormalization to aid performance in the volume cases. For example: • A field to indicate of the document is ‘public’ assuming you have a large volume of public documents • A field indicating the document owner Used as such: • Query:

SELECT * FROM documents d WHERE d.text="something super important"

• Filter:

Foreach result: filter {document.isPublic || document.ownerId == 1234 || keto.checkPermission(user, document, "read")

As for the layered approach, I’d mulled that too. Say the user is searching within a ‘Collection’ of documents, and the Collection in Keto grants the requested permission to the given user for constituent Documents - then filtering in the database for Documents that are members of the given Collection is sufficient. So in approximate practise: • User requests read permission for documents in the ‘dogs’ Collection • App runs:

if keto.checkPermission(user, dog-collection-id, "read") { 
    return SELECT * FROM documents d WHERE d.parent_collection = <dogs-collection-id>
} else { 
  // default filtering
}

Again denormalization, replicating the collection/document hierarchy in Keto and the database. However you cut it, it leaks the permission outside of Keto which irks, but I have feeling pragmatism trumps Pretty early thinking though, I too am formulating!

My intent is to use self-hosted Ory keto, and so I’m inclined to just poke around the database and see if I can muster up some queries myself. I agree that leaking permissions is irksome so I’d like to avoid it if possible, but I’m not sure it is.