ex-schema-configmap.yaml

kind: ConfigMap
apiVersion: v1
metadata:
  name: spicedb-schema
data:
  schema.yaml: |-
    schema: |-
      definition user {}

      definition group {
        relation member: user | group#member
      }

      definition role {
        relation view_the_thing: user:*
      }

      definition role_binding {
        relation subject : user | group#member
        relation granted: role

        permission view_the_thing = subject & granted->view_the_thing
      }

      definition workspace {
        relation parent: workspace
        relation user_grant: role_binding

        permission view_the_thing = user_grant->view_the_thing
      }

      definition thing {
        relation workspace: workspace

        permission view = workspace->view_the_thing
      }