February 2025 Summaries

The SpiceDB team has introduced a new experimental feature called Relationship Expiration, which allows users to specify an expiration time for relationships. This feature is part of the SpiceDB v1.40 release and enables users to model time-bounded access control for their resources. The introduction of Relationship Expiration is based on the concept of Relationship Caveats, which were introduced earlier as a way to support conditional relationships. However, many users found that they only needed expiration itself, rather than the full expressiveness of caveats. To address this, SpiceDB has crafted an experience specifically for expiration, which steers users away from tradeoffs associated with caveats. The feature uses the opaque values encoded into SpiceDB's ZedTokens as logical clocks to provide consistency guarantees throughout the system.

SpiceDB has released an experimental version of Relationship Expiration, which allows for the management of time-bound permissions directly within SpiceDB. This feature aims to simplify secure access management by providing a straightforward and dynamic way to grant temporary access to sensitive data. By leveraging this new feature, developers can build more efficient, secure, and flexible applications with fine-grained access control. The feature is designed to reduce administrative overhead and minimize security risks associated with manual access management. It also enables users to define expiration limits for resources they manage, unlocking powerful workflows like time-limited review cycles or project-based access. Additionally, the feature optimizes permissions systems by reducing database size and load on system, leading to more performant authorization checks and lower costs.