From 0051a45da532299caf475b82847a1e5b58a4fc44 Mon Sep 17 00:00:00 2001
From: Jake Moshenko <jacob.moshenko@gmail.com>
Date: Thu, 11 May 2023 08:59:11 -0400
Subject: [PATCH 1/3] Add support for experimental bulk load API.

---
 buf.gen.yaml                                  |   2 +-
 proto/apidocs.swagger.json                    |  70 +++-
 proto/authzed/api/v1/core.pb.go               |   4 +-
 .../authzed/api/v1/experimental_service.pb.go | 247 +++++++++++++
 .../api/v1/experimental_service.pb.gw.go      | 163 +++++++++
 .../v1/experimental_service.pb.validate.go    | 289 +++++++++++++++
 .../api/v1/experimental_service_grpc.pb.go    | 157 +++++++++
 .../api/v1/experimental_service_vtproto.pb.go | 328 ++++++++++++++++++
 proto/authzed/api/v1/permission_service.pb.go |  42 +--
 proto/authzed/api/v1/schema_service.pb.go     |   8 +-
 proto/authzed/api/v1/watch_service.pb.go      |   4 +-
 .../api/v1alpha1/watchresources_service.pb.go |   6 +-
 v1/client.go                                  |  40 ++-
 13 files changed, 1318 insertions(+), 42 deletions(-)
 create mode 100644 proto/authzed/api/v1/experimental_service.pb.go
 create mode 100644 proto/authzed/api/v1/experimental_service.pb.gw.go
 create mode 100644 proto/authzed/api/v1/experimental_service.pb.validate.go
 create mode 100644 proto/authzed/api/v1/experimental_service_grpc.pb.go
 create mode 100644 proto/authzed/api/v1/experimental_service_vtproto.pb.go

diff --git a/buf.gen.yaml b/buf.gen.yaml
index 4e21b58..caf2a18 100755
--- a/buf.gen.yaml
+++ b/buf.gen.yaml
@@ -1,4 +1,4 @@
-#!/usr/bin/env -S buf generate buf.build/authzed/api:d7e27e8163e5b6fddc0e3f989c8aefad8ca81184 --template
+#!/usr/bin/env -S buf generate buf.build/authzed/api:09d25203f9c83dbdb859e197824003f1b313f886 --template
 ---
 version: "v1"
 plugins:
diff --git a/proto/apidocs.swagger.json b/proto/apidocs.swagger.json
index 4872330..fd213e7 100644
--- a/proto/apidocs.swagger.json
+++ b/proto/apidocs.swagger.json
@@ -17,6 +17,9 @@
     {
       "name": "DeveloperService"
     },
+    {
+      "name": "ExperimentalService"
+    },
     {
       "name": "PermissionsService"
     },
@@ -45,6 +48,41 @@
     "application/json"
   ],
   "paths": {
+    "/v1/experimental/relationships/bulkload": {
+      "post": {
+        "summary": "BulkLoadRelationships is a faster path to writing a large number of\nrelationships at once. It is both batched and streaming. For maximum\nperformance, the caller should attempt to write relationships in as close\nto relationship sort order as possible: (resource.object_type,\nresource.object_id, relation, subject.object.object_type,\nsubject.object.object_id, subject.optional_relation)",
+        "description": "EXPERIMENTAL\nhttps://github.com/authzed/spicedb/issues/1303",
+        "operationId": "ExperimentalService_BulkLoadRelationships",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1BulkLoadRelationshipsResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "description": "BulkLoadRelationshipsRequest represents one batch of the streaming\nBulkLoadRelationships API. The maximum size is only limited by the backing\ndatastore, and optimal size should be determined by the calling client\nexperimentally. (streaming inputs)",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1BulkLoadRelationshipsRequest"
+            }
+          }
+        ],
+        "tags": [
+          "ExperimentalService"
+        ]
+      }
+    },
     "/v1/permissions/check": {
       "post": {
         "summary": "CheckPermission determines for a given resource whether a subject computes\nto having a permission or is a direct member of a particular relation.",
@@ -825,6 +863,28 @@
       ],
       "default": "OPERATION_UNSPECIFIED"
     },
+    "v1BulkLoadRelationshipsRequest": {
+      "type": "object",
+      "properties": {
+        "relationships": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1Relationship"
+          }
+        }
+      },
+      "description": "BulkLoadRelationshipsRequest represents one batch of the streaming\nBulkLoadRelationships API. The maximum size is only limited by the backing\ndatastore, and optimal size should be determined by the calling client\nexperimentally."
+    },
+    "v1BulkLoadRelationshipsResponse": {
+      "type": "object",
+      "properties": {
+        "numLoaded": {
+          "type": "string",
+          "format": "uint64"
+        }
+      },
+      "description": "BulkLoadRelationshipsResponse is returned on successful completion of the\nbulk load stream, and contains the total number of relationships loaded."
+    },
     "v1CheckPermissionRequest": {
       "type": "object",
       "properties": {
@@ -845,7 +905,7 @@
         },
         "context": {
           "type": "object",
-          "title": "context consists of named values that are injected into the caveat evaluation context *"
+          "title": "context consists of named values that are injected into the caveat evaluation context"
         }
       },
       "description": "CheckPermissionRequest issues a check on whether a subject has a permission\nor is a member of a relation, on a specific resource."
@@ -903,11 +963,11 @@
       "properties": {
         "caveatName": {
           "type": "string",
-          "title": "caveat_name is the name of the caveat expression to use, as defined in the schema *"
+          "title": "caveat_name is the name of the caveat expression to use, as defined in the schema"
         },
         "context": {
           "type": "object",
-          "title": "context consists of any named values that are defined at write time for the caveat expression *"
+          "title": "context consists of any named values that are defined at write time for the caveat expression"
         }
       },
       "description": "ContextualizedCaveat represents a reference to a caveat to be used by caveated relationships.\nThe context consists of key-value pairs that will be injected at evaluation time.\nThe keys must match the arguments defined on the caveat in the schema."
@@ -1029,7 +1089,7 @@
         },
         "context": {
           "type": "object",
-          "title": "context consists of named values that are injected into the caveat evaluation context *"
+          "title": "context consists of named values that are injected into the caveat evaluation context"
         },
         "optionalLimit": {
           "type": "integer",
@@ -1093,7 +1153,7 @@
         },
         "context": {
           "type": "object",
-          "title": "context consists of named values that are injected into the caveat evaluation context *"
+          "title": "context consists of named values that are injected into the caveat evaluation context"
         }
       },
       "description": "LookupSubjectsRequest performs a lookup of all subjects of a particular\nkind for which the subject has the specified permission or the relation in\nwhich the subject exists, streaming back the IDs of those subjects."
diff --git a/proto/authzed/api/v1/core.pb.go b/proto/authzed/api/v1/core.pb.go
index ed6afd7..2dc88fa 100644
--- a/proto/authzed/api/v1/core.pb.go
+++ b/proto/authzed/api/v1/core.pb.go
@@ -212,9 +212,9 @@ type ContextualizedCaveat struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// caveat_name is the name of the caveat expression to use, as defined in the schema *
+	// caveat_name is the name of the caveat expression to use, as defined in the schema
 	CaveatName string `protobuf:"bytes,1,opt,name=caveat_name,json=caveatName,proto3" json:"caveat_name,omitempty"`
-	// context consists of any named values that are defined at write time for the caveat expression *
+	// context consists of any named values that are defined at write time for the caveat expression
 	Context *structpb.Struct `protobuf:"bytes,2,opt,name=context,proto3" json:"context,omitempty"`
 }
 
diff --git a/proto/authzed/api/v1/experimental_service.pb.go b/proto/authzed/api/v1/experimental_service.pb.go
new file mode 100644
index 0000000..29938e0
--- /dev/null
+++ b/proto/authzed/api/v1/experimental_service.pb.go
@@ -0,0 +1,247 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: authzed/api/v1/experimental_service.proto
+
+package v1
+
+import (
+	_ "github.com/envoyproxy/protoc-gen-validate/validate"
+	_ "google.golang.org/genproto/googleapis/api/annotations"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// BulkLoadRelationshipsRequest represents one batch of the streaming
+// BulkLoadRelationships API. The maximum size is only limited by the backing
+// datastore, and optimal size should be determined by the calling client
+// experimentally.
+type BulkLoadRelationshipsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Relationships []*Relationship `protobuf:"bytes,1,rep,name=relationships,proto3" json:"relationships,omitempty"`
+}
+
+func (x *BulkLoadRelationshipsRequest) Reset() {
+	*x = BulkLoadRelationshipsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_authzed_api_v1_experimental_service_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BulkLoadRelationshipsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BulkLoadRelationshipsRequest) ProtoMessage() {}
+
+func (x *BulkLoadRelationshipsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_authzed_api_v1_experimental_service_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BulkLoadRelationshipsRequest.ProtoReflect.Descriptor instead.
+func (*BulkLoadRelationshipsRequest) Descriptor() ([]byte, []int) {
+	return file_authzed_api_v1_experimental_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *BulkLoadRelationshipsRequest) GetRelationships() []*Relationship {
+	if x != nil {
+		return x.Relationships
+	}
+	return nil
+}
+
+// BulkLoadRelationshipsResponse is returned on successful completion of the
+// bulk load stream, and contains the total number of relationships loaded.
+type BulkLoadRelationshipsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NumLoaded uint64 `protobuf:"varint,1,opt,name=num_loaded,json=numLoaded,proto3" json:"num_loaded,omitempty"`
+}
+
+func (x *BulkLoadRelationshipsResponse) Reset() {
+	*x = BulkLoadRelationshipsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_authzed_api_v1_experimental_service_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BulkLoadRelationshipsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BulkLoadRelationshipsResponse) ProtoMessage() {}
+
+func (x *BulkLoadRelationshipsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_authzed_api_v1_experimental_service_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BulkLoadRelationshipsResponse.ProtoReflect.Descriptor instead.
+func (*BulkLoadRelationshipsResponse) Descriptor() ([]byte, []int) {
+	return file_authzed_api_v1_experimental_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *BulkLoadRelationshipsResponse) GetNumLoaded() uint64 {
+	if x != nil {
+		return x.NumLoaded
+	}
+	return 0
+}
+
+var File_authzed_api_v1_experimental_service_proto protoreflect.FileDescriptor
+
+var file_authzed_api_v1_experimental_service_proto_rawDesc = []byte{
+	0x0a, 0x29, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31,
+	0x2f, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x5f, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0e, 0x61, 0x75, 0x74,
+	0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x1a, 0x1c, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x17, 0x76, 0x61, 0x6c, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x1a, 0x19, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f,
+	0x76, 0x31, 0x2f, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x71, 0x0a,
+	0x1c, 0x42, 0x75, 0x6c, 0x6b, 0x4c, 0x6f, 0x61, 0x64, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x51, 0x0a,
+	0x0d, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68,
+	0x69, 0x70, 0x42, 0x0d, 0xfa, 0x42, 0x0a, 0x92, 0x01, 0x07, 0x22, 0x05, 0x8a, 0x01, 0x02, 0x10,
+	0x01, 0x52, 0x0d, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73,
+	0x22, 0x3e, 0x0a, 0x1d, 0x42, 0x75, 0x6c, 0x6b, 0x4c, 0x6f, 0x61, 0x64, 0x52, 0x65, 0x6c, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6e, 0x75, 0x6d, 0x5f, 0x6c, 0x6f, 0x61, 0x64, 0x65, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6e, 0x75, 0x6d, 0x4c, 0x6f, 0x61, 0x64, 0x65, 0x64,
+	0x32, 0xc2, 0x01, 0x0a, 0x13, 0x45, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61,
+	0x6c, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0xaa, 0x01, 0x0a, 0x15, 0x42, 0x75, 0x6c,
+	0x6b, 0x4c, 0x6f, 0x61, 0x64, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69,
+	0x70, 0x73, 0x12, 0x2c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75, 0x6c, 0x6b, 0x4c, 0x6f, 0x61, 0x64, 0x52, 0x65, 0x6c, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x2d, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76,
+	0x31, 0x2e, 0x42, 0x75, 0x6c, 0x6b, 0x4c, 0x6f, 0x61, 0x64, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x32, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x2c, 0x3a, 0x01, 0x2a, 0x22, 0x27, 0x2f, 0x76, 0x31, 0x2f,
+	0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2f, 0x72, 0x65, 0x6c,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x2f, 0x62, 0x75, 0x6c, 0x6b, 0x6c,
+	0x6f, 0x61, 0x64, 0x28, 0x01, 0x42, 0x48, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x61, 0x75, 0x74,
+	0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x5a, 0x32, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f,
+	0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2d, 0x67, 0x6f, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_authzed_api_v1_experimental_service_proto_rawDescOnce sync.Once
+	file_authzed_api_v1_experimental_service_proto_rawDescData = file_authzed_api_v1_experimental_service_proto_rawDesc
+)
+
+func file_authzed_api_v1_experimental_service_proto_rawDescGZIP() []byte {
+	file_authzed_api_v1_experimental_service_proto_rawDescOnce.Do(func() {
+		file_authzed_api_v1_experimental_service_proto_rawDescData = protoimpl.X.CompressGZIP(file_authzed_api_v1_experimental_service_proto_rawDescData)
+	})
+	return file_authzed_api_v1_experimental_service_proto_rawDescData
+}
+
+var file_authzed_api_v1_experimental_service_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_authzed_api_v1_experimental_service_proto_goTypes = []interface{}{
+	(*BulkLoadRelationshipsRequest)(nil),  // 0: authzed.api.v1.BulkLoadRelationshipsRequest
+	(*BulkLoadRelationshipsResponse)(nil), // 1: authzed.api.v1.BulkLoadRelationshipsResponse
+	(*Relationship)(nil),                  // 2: authzed.api.v1.Relationship
+}
+var file_authzed_api_v1_experimental_service_proto_depIdxs = []int32{
+	2, // 0: authzed.api.v1.BulkLoadRelationshipsRequest.relationships:type_name -> authzed.api.v1.Relationship
+	0, // 1: authzed.api.v1.ExperimentalService.BulkLoadRelationships:input_type -> authzed.api.v1.BulkLoadRelationshipsRequest
+	1, // 2: authzed.api.v1.ExperimentalService.BulkLoadRelationships:output_type -> authzed.api.v1.BulkLoadRelationshipsResponse
+	2, // [2:3] is the sub-list for method output_type
+	1, // [1:2] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_authzed_api_v1_experimental_service_proto_init() }
+func file_authzed_api_v1_experimental_service_proto_init() {
+	if File_authzed_api_v1_experimental_service_proto != nil {
+		return
+	}
+	file_authzed_api_v1_core_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_authzed_api_v1_experimental_service_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BulkLoadRelationshipsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_authzed_api_v1_experimental_service_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BulkLoadRelationshipsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_authzed_api_v1_experimental_service_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_authzed_api_v1_experimental_service_proto_goTypes,
+		DependencyIndexes: file_authzed_api_v1_experimental_service_proto_depIdxs,
+		MessageInfos:      file_authzed_api_v1_experimental_service_proto_msgTypes,
+	}.Build()
+	File_authzed_api_v1_experimental_service_proto = out.File
+	file_authzed_api_v1_experimental_service_proto_rawDesc = nil
+	file_authzed_api_v1_experimental_service_proto_goTypes = nil
+	file_authzed_api_v1_experimental_service_proto_depIdxs = nil
+}
diff --git a/proto/authzed/api/v1/experimental_service.pb.gw.go b/proto/authzed/api/v1/experimental_service.pb.gw.go
new file mode 100644
index 0000000..44906be
--- /dev/null
+++ b/proto/authzed/api/v1/experimental_service.pb.gw.go
@@ -0,0 +1,163 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: authzed/api/v1/experimental_service.proto
+
+/*
+Package v1 is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package v1
+
+import (
+	"context"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var _ codes.Code
+var _ io.Reader
+var _ status.Status
+var _ = runtime.String
+var _ = utilities.NewDoubleArray
+var _ = metadata.Join
+
+func request_ExperimentalService_BulkLoadRelationships_0(ctx context.Context, marshaler runtime.Marshaler, client ExperimentalServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var metadata runtime.ServerMetadata
+	stream, err := client.BulkLoadRelationships(ctx)
+	if err != nil {
+		grpclog.Infof("Failed to start streaming: %v", err)
+		return nil, metadata, err
+	}
+	dec := marshaler.NewDecoder(req.Body)
+	for {
+		var protoReq BulkLoadRelationshipsRequest
+		err = dec.Decode(&protoReq)
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			grpclog.Infof("Failed to decode request: %v", err)
+			return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+		}
+		if err = stream.Send(&protoReq); err != nil {
+			if err == io.EOF {
+				break
+			}
+			grpclog.Infof("Failed to send request: %v", err)
+			return nil, metadata, err
+		}
+	}
+
+	if err := stream.CloseSend(); err != nil {
+		grpclog.Infof("Failed to terminate client stream: %v", err)
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		grpclog.Infof("Failed to get header from client: %v", err)
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+
+	msg, err := stream.CloseAndRecv()
+	metadata.TrailerMD = stream.Trailer()
+	return msg, metadata, err
+
+}
+
+// RegisterExperimentalServiceHandlerServer registers the http handlers for service ExperimentalService to "mux".
+// UnaryRPC     :call ExperimentalServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterExperimentalServiceHandlerFromEndpoint instead.
+func RegisterExperimentalServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server ExperimentalServiceServer) error {
+
+	mux.Handle("POST", pattern_ExperimentalService_BulkLoadRelationships_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	return nil
+}
+
+// RegisterExperimentalServiceHandlerFromEndpoint is same as RegisterExperimentalServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterExperimentalServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.Dial(endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+
+	return RegisterExperimentalServiceHandler(ctx, mux, conn)
+}
+
+// RegisterExperimentalServiceHandler registers the http handlers for service ExperimentalService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterExperimentalServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterExperimentalServiceHandlerClient(ctx, mux, NewExperimentalServiceClient(conn))
+}
+
+// RegisterExperimentalServiceHandlerClient registers the http handlers for service ExperimentalService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "ExperimentalServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "ExperimentalServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "ExperimentalServiceClient" to call the correct interceptors.
+func RegisterExperimentalServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client ExperimentalServiceClient) error {
+
+	mux.Handle("POST", pattern_ExperimentalService_BulkLoadRelationships_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/authzed.api.v1.ExperimentalService/BulkLoadRelationships", runtime.WithHTTPPathPattern("/v1/experimental/relationships/bulkload"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ExperimentalService_BulkLoadRelationships_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ExperimentalService_BulkLoadRelationships_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	return nil
+}
+
+var (
+	pattern_ExperimentalService_BulkLoadRelationships_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "experimental", "relationships", "bulkload"}, ""))
+)
+
+var (
+	forward_ExperimentalService_BulkLoadRelationships_0 = runtime.ForwardResponseMessage
+)
diff --git a/proto/authzed/api/v1/experimental_service.pb.validate.go b/proto/authzed/api/v1/experimental_service.pb.validate.go
new file mode 100644
index 0000000..9508e99
--- /dev/null
+++ b/proto/authzed/api/v1/experimental_service.pb.validate.go
@@ -0,0 +1,289 @@
+// Code generated by protoc-gen-validate. DO NOT EDIT.
+// source: authzed/api/v1/experimental_service.proto
+
+package v1
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"net"
+	"net/mail"
+	"net/url"
+	"regexp"
+	"sort"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+// ensure the imports are used
+var (
+	_ = bytes.MinRead
+	_ = errors.New("")
+	_ = fmt.Print
+	_ = utf8.UTFMax
+	_ = (*regexp.Regexp)(nil)
+	_ = (*strings.Reader)(nil)
+	_ = net.IPv4len
+	_ = time.Duration(0)
+	_ = (*url.URL)(nil)
+	_ = (*mail.Address)(nil)
+	_ = anypb.Any{}
+	_ = sort.Sort
+)
+
+// Validate checks the field values on BulkLoadRelationshipsRequest with the
+// rules defined in the proto definition for this message. If any rules are
+// violated, the first error encountered is returned, or nil if there are no violations.
+func (m *BulkLoadRelationshipsRequest) Validate() error {
+	return m.validate(false)
+}
+
+// ValidateAll checks the field values on BulkLoadRelationshipsRequest with the
+// rules defined in the proto definition for this message. If any rules are
+// violated, the result is a list of violation errors wrapped in
+// BulkLoadRelationshipsRequestMultiError, or nil if none found.
+func (m *BulkLoadRelationshipsRequest) ValidateAll() error {
+	return m.validate(true)
+}
+
+func (m *BulkLoadRelationshipsRequest) validate(all bool) error {
+	if m == nil {
+		return nil
+	}
+
+	var errors []error
+
+	for idx, item := range m.GetRelationships() {
+		_, _ = idx, item
+
+		if item == nil {
+			err := BulkLoadRelationshipsRequestValidationError{
+				field:  fmt.Sprintf("Relationships[%v]", idx),
+				reason: "value is required",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
+
+		if all {
+			switch v := interface{}(item).(type) {
+			case interface{ ValidateAll() error }:
+				if err := v.ValidateAll(); err != nil {
+					errors = append(errors, BulkLoadRelationshipsRequestValidationError{
+						field:  fmt.Sprintf("Relationships[%v]", idx),
+						reason: "embedded message failed validation",
+						cause:  err,
+					})
+				}
+			case interface{ Validate() error }:
+				if err := v.Validate(); err != nil {
+					errors = append(errors, BulkLoadRelationshipsRequestValidationError{
+						field:  fmt.Sprintf("Relationships[%v]", idx),
+						reason: "embedded message failed validation",
+						cause:  err,
+					})
+				}
+			}
+		} else if v, ok := interface{}(item).(interface{ Validate() error }); ok {
+			if err := v.Validate(); err != nil {
+				return BulkLoadRelationshipsRequestValidationError{
+					field:  fmt.Sprintf("Relationships[%v]", idx),
+					reason: "embedded message failed validation",
+					cause:  err,
+				}
+			}
+		}
+
+	}
+
+	if len(errors) > 0 {
+		return BulkLoadRelationshipsRequestMultiError(errors)
+	}
+
+	return nil
+}
+
+// BulkLoadRelationshipsRequestMultiError is an error wrapping multiple
+// validation errors returned by BulkLoadRelationshipsRequest.ValidateAll() if
+// the designated constraints aren't met.
+type BulkLoadRelationshipsRequestMultiError []error
+
+// Error returns a concatenation of all the error messages it wraps.
+func (m BulkLoadRelationshipsRequestMultiError) Error() string {
+	var msgs []string
+	for _, err := range m {
+		msgs = append(msgs, err.Error())
+	}
+	return strings.Join(msgs, "; ")
+}
+
+// AllErrors returns a list of validation violation errors.
+func (m BulkLoadRelationshipsRequestMultiError) AllErrors() []error { return m }
+
+// BulkLoadRelationshipsRequestValidationError is the validation error returned
+// by BulkLoadRelationshipsRequest.Validate if the designated constraints
+// aren't met.
+type BulkLoadRelationshipsRequestValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e BulkLoadRelationshipsRequestValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e BulkLoadRelationshipsRequestValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e BulkLoadRelationshipsRequestValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e BulkLoadRelationshipsRequestValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e BulkLoadRelationshipsRequestValidationError) ErrorName() string {
+	return "BulkLoadRelationshipsRequestValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e BulkLoadRelationshipsRequestValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sBulkLoadRelationshipsRequest.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = BulkLoadRelationshipsRequestValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = BulkLoadRelationshipsRequestValidationError{}
+
+// Validate checks the field values on BulkLoadRelationshipsResponse with the
+// rules defined in the proto definition for this message. If any rules are
+// violated, the first error encountered is returned, or nil if there are no violations.
+func (m *BulkLoadRelationshipsResponse) Validate() error {
+	return m.validate(false)
+}
+
+// ValidateAll checks the field values on BulkLoadRelationshipsResponse with
+// the rules defined in the proto definition for this message. If any rules
+// are violated, the result is a list of violation errors wrapped in
+// BulkLoadRelationshipsResponseMultiError, or nil if none found.
+func (m *BulkLoadRelationshipsResponse) ValidateAll() error {
+	return m.validate(true)
+}
+
+func (m *BulkLoadRelationshipsResponse) validate(all bool) error {
+	if m == nil {
+		return nil
+	}
+
+	var errors []error
+
+	// no validation rules for NumLoaded
+
+	if len(errors) > 0 {
+		return BulkLoadRelationshipsResponseMultiError(errors)
+	}
+
+	return nil
+}
+
+// BulkLoadRelationshipsResponseMultiError is an error wrapping multiple
+// validation errors returned by BulkLoadRelationshipsResponse.ValidateAll()
+// if the designated constraints aren't met.
+type BulkLoadRelationshipsResponseMultiError []error
+
+// Error returns a concatenation of all the error messages it wraps.
+func (m BulkLoadRelationshipsResponseMultiError) Error() string {
+	var msgs []string
+	for _, err := range m {
+		msgs = append(msgs, err.Error())
+	}
+	return strings.Join(msgs, "; ")
+}
+
+// AllErrors returns a list of validation violation errors.
+func (m BulkLoadRelationshipsResponseMultiError) AllErrors() []error { return m }
+
+// BulkLoadRelationshipsResponseValidationError is the validation error
+// returned by BulkLoadRelationshipsResponse.Validate if the designated
+// constraints aren't met.
+type BulkLoadRelationshipsResponseValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e BulkLoadRelationshipsResponseValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e BulkLoadRelationshipsResponseValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e BulkLoadRelationshipsResponseValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e BulkLoadRelationshipsResponseValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e BulkLoadRelationshipsResponseValidationError) ErrorName() string {
+	return "BulkLoadRelationshipsResponseValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e BulkLoadRelationshipsResponseValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sBulkLoadRelationshipsResponse.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = BulkLoadRelationshipsResponseValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = BulkLoadRelationshipsResponseValidationError{}
diff --git a/proto/authzed/api/v1/experimental_service_grpc.pb.go b/proto/authzed/api/v1/experimental_service_grpc.pb.go
new file mode 100644
index 0000000..6496253
--- /dev/null
+++ b/proto/authzed/api/v1/experimental_service_grpc.pb.go
@@ -0,0 +1,157 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.2.0
+// - protoc             (unknown)
+// source: authzed/api/v1/experimental_service.proto
+
+package v1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+// ExperimentalServiceClient is the client API for ExperimentalService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type ExperimentalServiceClient interface {
+	// BulkLoadRelationships is a faster path to writing a large number of
+	// relationships at once. It is both batched and streaming. For maximum
+	// performance, the caller should attempt to write relationships in as close
+	// to relationship sort order as possible: (resource.object_type,
+	// resource.object_id, relation, subject.object.object_type,
+	// subject.object.object_id, subject.optional_relation)
+	//
+	// EXPERIMENTAL
+	// https://github.com/authzed/spicedb/issues/1303
+	BulkLoadRelationships(ctx context.Context, opts ...grpc.CallOption) (ExperimentalService_BulkLoadRelationshipsClient, error)
+}
+
+type experimentalServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewExperimentalServiceClient(cc grpc.ClientConnInterface) ExperimentalServiceClient {
+	return &experimentalServiceClient{cc}
+}
+
+func (c *experimentalServiceClient) BulkLoadRelationships(ctx context.Context, opts ...grpc.CallOption) (ExperimentalService_BulkLoadRelationshipsClient, error) {
+	stream, err := c.cc.NewStream(ctx, &ExperimentalService_ServiceDesc.Streams[0], "/authzed.api.v1.ExperimentalService/BulkLoadRelationships", opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &experimentalServiceBulkLoadRelationshipsClient{stream}
+	return x, nil
+}
+
+type ExperimentalService_BulkLoadRelationshipsClient interface {
+	Send(*BulkLoadRelationshipsRequest) error
+	CloseAndRecv() (*BulkLoadRelationshipsResponse, error)
+	grpc.ClientStream
+}
+
+type experimentalServiceBulkLoadRelationshipsClient struct {
+	grpc.ClientStream
+}
+
+func (x *experimentalServiceBulkLoadRelationshipsClient) Send(m *BulkLoadRelationshipsRequest) error {
+	return x.ClientStream.SendMsg(m)
+}
+
+func (x *experimentalServiceBulkLoadRelationshipsClient) CloseAndRecv() (*BulkLoadRelationshipsResponse, error) {
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	m := new(BulkLoadRelationshipsResponse)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// ExperimentalServiceServer is the server API for ExperimentalService service.
+// All implementations must embed UnimplementedExperimentalServiceServer
+// for forward compatibility
+type ExperimentalServiceServer interface {
+	// BulkLoadRelationships is a faster path to writing a large number of
+	// relationships at once. It is both batched and streaming. For maximum
+	// performance, the caller should attempt to write relationships in as close
+	// to relationship sort order as possible: (resource.object_type,
+	// resource.object_id, relation, subject.object.object_type,
+	// subject.object.object_id, subject.optional_relation)
+	//
+	// EXPERIMENTAL
+	// https://github.com/authzed/spicedb/issues/1303
+	BulkLoadRelationships(ExperimentalService_BulkLoadRelationshipsServer) error
+	mustEmbedUnimplementedExperimentalServiceServer()
+}
+
+// UnimplementedExperimentalServiceServer must be embedded to have forward compatible implementations.
+type UnimplementedExperimentalServiceServer struct {
+}
+
+func (UnimplementedExperimentalServiceServer) BulkLoadRelationships(ExperimentalService_BulkLoadRelationshipsServer) error {
+	return status.Errorf(codes.Unimplemented, "method BulkLoadRelationships not implemented")
+}
+func (UnimplementedExperimentalServiceServer) mustEmbedUnimplementedExperimentalServiceServer() {}
+
+// UnsafeExperimentalServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ExperimentalServiceServer will
+// result in compilation errors.
+type UnsafeExperimentalServiceServer interface {
+	mustEmbedUnimplementedExperimentalServiceServer()
+}
+
+func RegisterExperimentalServiceServer(s grpc.ServiceRegistrar, srv ExperimentalServiceServer) {
+	s.RegisterService(&ExperimentalService_ServiceDesc, srv)
+}
+
+func _ExperimentalService_BulkLoadRelationships_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(ExperimentalServiceServer).BulkLoadRelationships(&experimentalServiceBulkLoadRelationshipsServer{stream})
+}
+
+type ExperimentalService_BulkLoadRelationshipsServer interface {
+	SendAndClose(*BulkLoadRelationshipsResponse) error
+	Recv() (*BulkLoadRelationshipsRequest, error)
+	grpc.ServerStream
+}
+
+type experimentalServiceBulkLoadRelationshipsServer struct {
+	grpc.ServerStream
+}
+
+func (x *experimentalServiceBulkLoadRelationshipsServer) SendAndClose(m *BulkLoadRelationshipsResponse) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+func (x *experimentalServiceBulkLoadRelationshipsServer) Recv() (*BulkLoadRelationshipsRequest, error) {
+	m := new(BulkLoadRelationshipsRequest)
+	if err := x.ServerStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// ExperimentalService_ServiceDesc is the grpc.ServiceDesc for ExperimentalService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ExperimentalService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "authzed.api.v1.ExperimentalService",
+	HandlerType: (*ExperimentalServiceServer)(nil),
+	Methods:     []grpc.MethodDesc{},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "BulkLoadRelationships",
+			Handler:       _ExperimentalService_BulkLoadRelationships_Handler,
+			ClientStreams: true,
+		},
+	},
+	Metadata: "authzed/api/v1/experimental_service.proto",
+}
diff --git a/proto/authzed/api/v1/experimental_service_vtproto.pb.go b/proto/authzed/api/v1/experimental_service_vtproto.pb.go
new file mode 100644
index 0000000..9cbd051
--- /dev/null
+++ b/proto/authzed/api/v1/experimental_service_vtproto.pb.go
@@ -0,0 +1,328 @@
+// Code generated by protoc-gen-go-vtproto. DO NOT EDIT.
+// protoc-gen-go-vtproto version: v0.3.1-0.20220817155510-0ae748fd2007
+// source: authzed/api/v1/experimental_service.proto
+
+package v1
+
+import (
+	fmt "fmt"
+	proto "google.golang.org/protobuf/proto"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	io "io"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+func (m *BulkLoadRelationshipsRequest) CloneVT() *BulkLoadRelationshipsRequest {
+	if m == nil {
+		return (*BulkLoadRelationshipsRequest)(nil)
+	}
+	r := &BulkLoadRelationshipsRequest{}
+	if rhs := m.Relationships; rhs != nil {
+		tmpContainer := make([]*Relationship, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.Relationships = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *BulkLoadRelationshipsRequest) CloneGenericVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *BulkLoadRelationshipsResponse) CloneVT() *BulkLoadRelationshipsResponse {
+	if m == nil {
+		return (*BulkLoadRelationshipsResponse)(nil)
+	}
+	r := &BulkLoadRelationshipsResponse{
+		NumLoaded: m.NumLoaded,
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *BulkLoadRelationshipsResponse) CloneGenericVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *BulkLoadRelationshipsRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *BulkLoadRelationshipsRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *BulkLoadRelationshipsRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Relationships) > 0 {
+		for iNdEx := len(m.Relationships) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Relationships[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *BulkLoadRelationshipsResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *BulkLoadRelationshipsResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *BulkLoadRelationshipsResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.NumLoaded != 0 {
+		i = encodeVarint(dAtA, i, uint64(m.NumLoaded))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *BulkLoadRelationshipsRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Relationships) > 0 {
+		for _, e := range m.Relationships {
+			l = e.SizeVT()
+			n += 1 + l + sov(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *BulkLoadRelationshipsResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.NumLoaded != 0 {
+		n += 1 + sov(uint64(m.NumLoaded))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *BulkLoadRelationshipsRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BulkLoadRelationshipsRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BulkLoadRelationshipsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Relationships", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Relationships = append(m.Relationships, &Relationship{})
+			if err := m.Relationships[len(m.Relationships)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *BulkLoadRelationshipsResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BulkLoadRelationshipsResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BulkLoadRelationshipsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NumLoaded", wireType)
+			}
+			m.NumLoaded = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.NumLoaded |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/proto/authzed/api/v1/permission_service.pb.go b/proto/authzed/api/v1/permission_service.pb.go
index ecf149b..00aa471 100644
--- a/proto/authzed/api/v1/permission_service.pb.go
+++ b/proto/authzed/api/v1/permission_service.pb.go
@@ -973,7 +973,7 @@ type CheckPermissionRequest struct {
 	Permission string `protobuf:"bytes,3,opt,name=permission,proto3" json:"permission,omitempty"`
 	// subject is the subject that will be checked for the permission or relation.
 	Subject *SubjectReference `protobuf:"bytes,4,opt,name=subject,proto3" json:"subject,omitempty"`
-	// context consists of named values that are injected into the caveat evaluation context *
+	// context consists of named values that are injected into the caveat evaluation context
 	Context *structpb.Struct `protobuf:"bytes,5,opt,name=context,proto3" json:"context,omitempty"`
 }
 
@@ -1264,7 +1264,7 @@ type LookupResourcesRequest struct {
 	Permission string `protobuf:"bytes,3,opt,name=permission,proto3" json:"permission,omitempty"`
 	// subject is the subject with access to the resources.
 	Subject *SubjectReference `protobuf:"bytes,4,opt,name=subject,proto3" json:"subject,omitempty"`
-	// context consists of named values that are injected into the caveat evaluation context *
+	// context consists of named values that are injected into the caveat evaluation context
 	Context *structpb.Struct `protobuf:"bytes,5,opt,name=context,proto3" json:"context,omitempty"`
 	// optional_limit, if non-zero, specifies the limit on the number of resources to return
 	// before the stream is closed on the server side. By default, the stream will continue
@@ -1464,7 +1464,7 @@ type LookupSubjectsRequest struct {
 	SubjectObjectType string `protobuf:"bytes,4,opt,name=subject_object_type,json=subjectObjectType,proto3" json:"subject_object_type,omitempty"`
 	// optional_subject_relation is the optional relation for the subject.
 	OptionalSubjectRelation string `protobuf:"bytes,5,opt,name=optional_subject_relation,json=optionalSubjectRelation,proto3" json:"optional_subject_relation,omitempty"`
-	// context consists of named values that are injected into the caveat evaluation context *
+	// context consists of named values that are injected into the caveat evaluation context
 	Context *structpb.Struct `protobuf:"bytes,6,opt,name=context,proto3" json:"context,omitempty"`
 }
 
@@ -2206,8 +2206,8 @@ var file_authzed_api_v1_permission_service_proto_rawDesc = []byte{
 	0x29, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31,
 	0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69,
 	0x70, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x21, 0x82, 0xd3, 0xe4, 0x93,
-	0x02, 0x1b, 0x22, 0x16, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x68, 0x69, 0x70, 0x73, 0x2f, 0x72, 0x65, 0x61, 0x64, 0x3a, 0x01, 0x2a, 0x30, 0x01, 0x12,
+	0x02, 0x1b, 0x3a, 0x01, 0x2a, 0x22, 0x16, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x6c, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x2f, 0x72, 0x65, 0x61, 0x64, 0x30, 0x01, 0x12,
 	0x8f, 0x01, 0x0a, 0x12, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f,
 	0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x12, 0x29, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64,
 	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x6c,
@@ -2215,26 +2215,26 @@ var file_authzed_api_v1_permission_service_proto_rawDesc = []byte{
 	0x74, 0x1a, 0x2a, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e,
 	0x76, 0x31, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e,
 	0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x22, 0x82,
-	0xd3, 0xe4, 0x93, 0x02, 0x1c, 0x22, 0x17, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x6c, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x2f, 0x77, 0x72, 0x69, 0x74, 0x65, 0x3a, 0x01,
-	0x2a, 0x12, 0x93, 0x01, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x6c, 0x61,
+	0xd3, 0xe4, 0x93, 0x02, 0x1c, 0x3a, 0x01, 0x2a, 0x22, 0x17, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65,
+	0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x2f, 0x77, 0x72, 0x69, 0x74,
+	0x65, 0x12, 0x93, 0x01, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x6c, 0x61,
 	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x12, 0x2a, 0x2e, 0x61, 0x75, 0x74, 0x68,
 	0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
 	0x65, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65,
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e,
 	0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x6c,
 	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x23, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1d, 0x22, 0x18, 0x2f, 0x76, 0x31, 0x2f,
-	0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x2f, 0x64, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x3a, 0x01, 0x2a, 0x12, 0x84, 0x01, 0x0a, 0x0f, 0x43, 0x68, 0x65, 0x63,
+	0x73, 0x65, 0x22, 0x23, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1d, 0x3a, 0x01, 0x2a, 0x22, 0x18, 0x2f,
+	0x76, 0x31, 0x2f, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73,
+	0x2f, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x84, 0x01, 0x0a, 0x0f, 0x43, 0x68, 0x65, 0x63,
 	0x6b, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x26, 0x2e, 0x61, 0x75,
 	0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x68, 0x65,
 	0x63, 0x6b, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
 	0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70,
 	0x69, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73,
 	0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x20, 0x82, 0xd3,
-	0xe4, 0x93, 0x02, 0x1a, 0x22, 0x15, 0x2f, 0x76, 0x31, 0x2f, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x3a, 0x01, 0x2a, 0x12, 0x94,
+	0xe4, 0x93, 0x02, 0x1a, 0x3a, 0x01, 0x2a, 0x22, 0x15, 0x2f, 0x76, 0x31, 0x2f, 0x70, 0x65, 0x72,
+	0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x94,
 	0x01, 0x0a, 0x14, 0x45, 0x78, 0x70, 0x61, 0x6e, 0x64, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73,
 	0x69, 0x6f, 0x6e, 0x54, 0x72, 0x65, 0x65, 0x12, 0x2b, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65,
 	0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x61, 0x6e, 0x64, 0x50,
@@ -2242,26 +2242,26 @@ var file_authzed_api_v1_permission_service_proto_rawDesc = []byte{
 	0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61,
 	0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x61, 0x6e, 0x64, 0x50, 0x65, 0x72, 0x6d,
 	0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x72, 0x65, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x21, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1b, 0x22, 0x16, 0x2f, 0x76, 0x31, 0x2f,
-	0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x65, 0x78, 0x70, 0x61,
-	0x6e, 0x64, 0x3a, 0x01, 0x2a, 0x12, 0x8a, 0x01, 0x0a, 0x0f, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70,
+	0x73, 0x65, 0x22, 0x21, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1b, 0x3a, 0x01, 0x2a, 0x22, 0x16, 0x2f,
+	0x76, 0x31, 0x2f, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x65,
+	0x78, 0x70, 0x61, 0x6e, 0x64, 0x12, 0x8a, 0x01, 0x0a, 0x0f, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70,
 	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x26, 0x2e, 0x61, 0x75, 0x74, 0x68,
 	0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x6f, 0x6b, 0x75,
 	0x70, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
 	0x74, 0x1a, 0x27, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e,
 	0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
 	0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x24, 0x82, 0xd3, 0xe4, 0x93,
-	0x02, 0x1e, 0x22, 0x19, 0x2f, 0x76, 0x31, 0x2f, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69,
-	0x6f, 0x6e, 0x73, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x3a, 0x01, 0x2a,
+	0x02, 0x1e, 0x3a, 0x01, 0x2a, 0x22, 0x19, 0x2f, 0x76, 0x31, 0x2f, 0x70, 0x65, 0x72, 0x6d, 0x69,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
 	0x30, 0x01, 0x12, 0x86, 0x01, 0x0a, 0x0e, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53, 0x75, 0x62,
 	0x6a, 0x65, 0x63, 0x74, 0x73, 0x12, 0x25, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e,
 	0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53, 0x75, 0x62,
 	0x6a, 0x65, 0x63, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x61,
 	0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f,
 	0x6f, 0x6b, 0x75, 0x70, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x23, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1d, 0x22, 0x18, 0x2f, 0x76,
-	0x31, 0x2f, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x73, 0x75,
-	0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x3a, 0x01, 0x2a, 0x30, 0x01, 0x42, 0x48, 0x0a, 0x12, 0x63,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x23, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1d, 0x3a, 0x01, 0x2a, 0x22,
+	0x18, 0x2f, 0x76, 0x31, 0x2f, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73,
+	0x2f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x30, 0x01, 0x42, 0x48, 0x0a, 0x12, 0x63,
 	0x6f, 0x6d, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76,
 	0x31, 0x5a, 0x32, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x61, 0x75,
 	0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2d, 0x67, 0x6f,
diff --git a/proto/authzed/api/v1/schema_service.pb.go b/proto/authzed/api/v1/schema_service.pb.go
index f396b73..068db21 100644
--- a/proto/authzed/api/v1/schema_service.pb.go
+++ b/proto/authzed/api/v1/schema_service.pb.go
@@ -228,15 +228,15 @@ var file_authzed_api_v1_schema_service_proto_rawDesc = []byte{
 	0x68, 0x65, 0x6d, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x61, 0x75,
 	0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x61,
 	0x64, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x1a, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x14, 0x22, 0x0f, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x63, 0x68,
-	0x65, 0x6d, 0x61, 0x2f, 0x72, 0x65, 0x61, 0x64, 0x3a, 0x01, 0x2a, 0x12, 0x73, 0x0a, 0x0b, 0x57,
+	0x1a, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x14, 0x3a, 0x01, 0x2a, 0x22, 0x0f, 0x2f, 0x76, 0x31, 0x2f,
+	0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2f, 0x72, 0x65, 0x61, 0x64, 0x12, 0x73, 0x0a, 0x0b, 0x57,
 	0x72, 0x69, 0x74, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x12, 0x22, 0x2e, 0x61, 0x75, 0x74,
 	0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x72, 0x69, 0x74,
 	0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23,
 	0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e,
 	0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x1b, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x15, 0x22, 0x10, 0x2f, 0x76, 0x31,
-	0x2f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2f, 0x77, 0x72, 0x69, 0x74, 0x65, 0x3a, 0x01, 0x2a,
+	0x6e, 0x73, 0x65, 0x22, 0x1b, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x15, 0x3a, 0x01, 0x2a, 0x22, 0x10,
+	0x2f, 0x76, 0x31, 0x2f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2f, 0x77, 0x72, 0x69, 0x74, 0x65,
 	0x42, 0x48, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e,
 	0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x5a, 0x32, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
 	0x6f, 0x6d, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a,
diff --git a/proto/authzed/api/v1/watch_service.pb.go b/proto/authzed/api/v1/watch_service.pb.go
index cefed9b..43f4d47 100644
--- a/proto/authzed/api/v1/watch_service.pb.go
+++ b/proto/authzed/api/v1/watch_service.pb.go
@@ -186,8 +186,8 @@ var file_authzed_api_v1_watch_service_proto_rawDesc = []byte{
 	0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65,
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e,
 	0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x14, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x0e, 0x22, 0x09, 0x2f, 0x76,
-	0x31, 0x2f, 0x77, 0x61, 0x74, 0x63, 0x68, 0x3a, 0x01, 0x2a, 0x30, 0x01, 0x42, 0x48, 0x0a, 0x12,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x14, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x0e, 0x3a, 0x01, 0x2a, 0x22,
+	0x09, 0x2f, 0x76, 0x31, 0x2f, 0x77, 0x61, 0x74, 0x63, 0x68, 0x30, 0x01, 0x42, 0x48, 0x0a, 0x12,
 	0x63, 0x6f, 0x6d, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e,
 	0x76, 0x31, 0x5a, 0x32, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x61,
 	0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2d, 0x67,
diff --git a/proto/authzed/api/v1alpha1/watchresources_service.pb.go b/proto/authzed/api/v1alpha1/watchresources_service.pb.go
index 4cb4c60..e478526 100644
--- a/proto/authzed/api/v1alpha1/watchresources_service.pb.go
+++ b/proto/authzed/api/v1alpha1/watchresources_service.pb.go
@@ -376,9 +376,9 @@ var file_authzed_api_v1alpha1_watchresources_service_proto_rawDesc = []byte{
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e,
 	0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x57, 0x61, 0x74,
 	0x63, 0x68, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x20, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1a, 0x22, 0x15, 0x2f, 0x76, 0x31,
-	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x77, 0x61, 0x74,
-	0x63, 0x68, 0x3a, 0x01, 0x2a, 0x30, 0x01, 0x42, 0x54, 0x0a, 0x18, 0x63, 0x6f, 0x6d, 0x2e, 0x61,
+	0x6e, 0x73, 0x65, 0x22, 0x20, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1a, 0x3a, 0x01, 0x2a, 0x22, 0x15,
+	0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70,
+	0x77, 0x61, 0x74, 0x63, 0x68, 0x30, 0x01, 0x42, 0x54, 0x0a, 0x18, 0x63, 0x6f, 0x6d, 0x2e, 0x61,
 	0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
 	0x68, 0x61, 0x31, 0x5a, 0x38, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
 	0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2d,
diff --git a/v1/client.go b/v1/client.go
index bd01b09..d94251a 100644
--- a/v1/client.go
+++ b/v1/client.go
@@ -16,12 +16,19 @@ type Client struct {
 	v1.WatchServiceClient
 }
 
+// ClientWithExperimental represents and open connection to Authzed with
+// experimental services available.
+//
+// Clients are backed by a gRPC client and as such are thread-safe.
+type ClientWithExperimental struct {
+	Client
+
+	v1.ExperimentalServiceClient
+}
+
 // NewClient initializes a brand new client for interacting with Authzed.
 func NewClient(endpoint string, opts ...grpc.DialOption) (*Client, error) {
-	conn, err := grpc.Dial(
-		stringz.DefaultEmpty(endpoint, "grpc.authzed.com:443"),
-		opts...,
-	)
+	conn, err := newConn(endpoint, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -32,3 +39,28 @@ func NewClient(endpoint string, opts ...grpc.DialOption) (*Client, error) {
 		v1.NewWatchServiceClient(conn),
 	}, nil
 }
+
+// NewClientWithExperimentalAPIs initializes a brand new client for interacting
+// with Authzed.
+func NewClientWithExperimentalAPIs(endpoint string, opts ...grpc.DialOption) (*ClientWithExperimental, error) {
+	conn, err := newConn(endpoint, opts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return &ClientWithExperimental{
+		Client{
+			v1.NewSchemaServiceClient(conn),
+			v1.NewPermissionsServiceClient(conn),
+			v1.NewWatchServiceClient(conn),
+		},
+		v1.NewExperimentalServiceClient(conn),
+	}, nil
+}
+
+func newConn(endpoint string, opts ...grpc.DialOption) (*grpc.ClientConn, error) {
+	return grpc.Dial(
+		stringz.DefaultEmpty(endpoint, "grpc.authzed.com:443"),
+		opts...,
+	)
+}

From 90ef468aa83c574ffb78f8251302c4280f66df87 Mon Sep 17 00:00:00 2001
From: Jake Moshenko <jacob.moshenko@gmail.com>
Date: Thu, 11 May 2023 15:20:37 -0400
Subject: [PATCH 2/3] Update install-tools script.

---
 .github/workflows/build.yaml | 2 +-
 hack/install-tools.sh        | 5 +++++
 install-tools.sh             | 2 --
 3 files changed, 6 insertions(+), 3 deletions(-)
 create mode 100755 hack/install-tools.sh
 delete mode 100755 install-tools.sh

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index b47ab1b..e7722f2 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -30,5 +30,5 @@ jobs:
         with:
           go-version: "~1.19"
       - name: "Install Go Tools"
-        run: "./install-tools.sh"
+        run: "./hack/install-tools.sh"
       - uses: "authzed/actions/buf-generate@main"
diff --git a/hack/install-tools.sh b/hack/install-tools.sh
new file mode 100755
index 0000000..176f0f2
--- /dev/null
+++ b/hack/install-tools.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+set -xeuo pipefail
+
+read -ra TOOLS < <(go list -f "{{range .Imports}}{{.}} {{end}}" tools.go)
+go install "${TOOLS[@]}"
diff --git a/install-tools.sh b/install-tools.sh
deleted file mode 100755
index 6bb5145..0000000
--- a/install-tools.sh
+++ /dev/null
@@ -1,2 +0,0 @@
-tools=$(go list -f '{{range .Imports}}{{.}} {{end}}' tools.go)
-go install $tools
\ No newline at end of file

From fa76505718615a595449450fb19c9accc967f1ff Mon Sep 17 00:00:00 2001
From: Jake Moshenko <jacob.moshenko@gmail.com>
Date: Thu, 11 May 2023 15:24:48 -0400
Subject: [PATCH 3/3] Update go version in CI build

---
 .github/workflows/build.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index e7722f2..c7cbe08 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -14,7 +14,7 @@ jobs:
       - uses: "actions/checkout@v3"
       - uses: "actions/setup-go@v3"
         with:
-          go-version: "~1.19"
+          go-version: "~1.20"
       - uses: "authzed/action-spicedb@v1"
       - uses: "authzed/actions/go-test@main"
         with:
@@ -28,7 +28,7 @@ jobs:
       - uses: "actions/checkout@v3"
       - uses: "actions/setup-go@v3"
         with:
-          go-version: "~1.19"
+          go-version: "~1.20"
       - name: "Install Go Tools"
         run: "./hack/install-tools.sh"
       - uses: "authzed/actions/buf-generate@main"