From 96cbfc93894fd4cec30d5186695d3fd96da27291 Mon Sep 17 00:00:00 2001 From: ivanauth Date: Wed, 26 Aug 2026 11:35:21 -0400 Subject: [PATCH] Add FAQ entry on authentication-layer revocation When SpiceDB is composed with a separate authentication layer such as an OAuth 2.0 provider, revoking a credential at that layer does not affect SpiceDB permission checks, since the granting relationships are unchanged. Operators composing the two layers can wrongly assume otherwise, so document the boundary and point at relationship deletion, expiration, and caveats for revoking access in SpiceDB itself. Signed-off-by: ivanauth --- app/spicedb/getting-started/faq/page.mdx | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/app/spicedb/getting-started/faq/page.mdx b/app/spicedb/getting-started/faq/page.mdx index 48d1df2e..2ac07aea 100644 --- a/app/spicedb/getting-started/faq/page.mdx +++ b/app/spicedb/getting-started/faq/page.mdx @@ -1,6 +1,6 @@ --- title: "Frequently-asked Questions" -description: "Answers to common SpiceDB questions on open-source licensing, IT infrastructure, policy engines, filtering resources by access, and getting involved." +description: "Answers to common SpiceDB questions on open-source licensing, IT infrastructure, policy engines, credential revocation, filtering resources by access, and getting involved." --- # Frequently-asked Questions @@ -51,6 +51,25 @@ For these scenarios, SpiceDB supports [Caveats] as a light-weight form of policy [Reverse Indices]: ../concepts/zanzibar/#reverse-indices [caveats]: ../concepts/caveats +## Does SpiceDB revoke permissions when an OAuth token or session is revoked? + +No. +SpiceDB is an authorization system, not an authentication system. +A permission check is computed from the schema and relationships stored in SpiceDB, together with any caveat context stored on those relationships or supplied with the request; relationships with expiration also depend on the datastore's clock. +SpiceDB does not consult any external credential state. + +SpiceDB is commonly deployed behind a separate authentication layer, such as an OAuth 2.0 provider, that verifies who the caller is before the application asks SpiceDB what the caller may do. +Revoking a credential at that layer affects only that layer, and how quickly it takes effect depends on the credential: a revoked opaque token or session stops working at the next introspection, while a self-contained JWT is typically accepted until it expires. +Either way, revocation does not remove any relationships, so SpiceDB permission checks for that subject continue to succeed for as long as the granting relationships exist. +The same applies to `LookupResources` and `LookupSubjects`, which resolve from the same stored state. + +To remove a subject's access in SpiceDB, delete the relationships that grant it, or model time-bound access with [expiring relationships] or [Caveats]. +Note that a check using the default `minimize_latency` [consistency] mode can be served from a cached snapshot, so it may not observe a relationship deletion immediately; see [read-after-write] for that window and how to close it. + +[expiring relationships]: ../concepts/expiring-relationships +[consistency]: ../concepts/consistency +[read-after-write]: ../concepts/read-after-write + ## How do I filter resources based on access decisions in SpiceDB? There are three approaches for filtering resources based on whether users have access to them: