This bit:
Setting up relationship integrity
To run with relationship integrity, new flags must be given to SpiceDB:
spicedb serve ...existing flags...
--datastore-relationship-integrity-enabled
--datastore-relationship-integrity-current-key-id="somekeyid"
--datastore-relationship-integrity-current-key-filename="some.key"
Place the generated key contents (which must support an HMAC key) in some.key
It's not clear when/where this key generation happens.
This bit:
It's not clear when/where this key generation happens.