I'm looking to set-up Keto to control access to various external services, I can either do this by

user1#foo@true

or

user1#service@foo

(assuming

foo

is the service) -- is one of these ways better or preferred, or does it not matter?

I would probably go with something like:

services:foo#access@user1

I.e namespacing the object (

services:foo

) to which the subject (

user1

) should have the relation

access

. If that makes sense. I'd prefer this as it can be read as "User1 has Access to the Service Foo"