Relation tuples checking error

[Rudkovskiy427]

I am using Ory Keto v0.12.0-alpha.0 to implement the following relationships in a service:
User1 is a member of Group1; Group1 has the editors relation to Document1.
Therefore, User1 should be able to edit Document1.

The problem is that, periodically, when checking User1's permissions using the GET relation-tuples/check endpoint:

{
  "namespace": "docs",
  "relation": "edit",
  "subject": "user1_uuid",
  "object": "document1_uuid"
}

the response returns allowed=false instead of true. Notably, for some time, the check returns true as expected, and then, unexpectedly, it starts returning false—indicating the user no longer has permission to edit the document—but then it goes back to normal, and the user regains access.

During all this, the relationships between User1, Group1, and Document1 do not change. Reviewing the logs provided no insight—what I saw were just the responses to the relation-tuples/check requests.

Please advise what might be causing this issue and where to look. I'd like to note that all relationships between the entities are correctly set, yet the user's access occasionally disappears.

[vinckr]

Hello @Rudkovskiy427

can you please share the steps to reproduce this on a fresh install?

if the relationships do not change the response should be consistent.

Reviewing the logs provided no insight—what I saw were just the responses to the relation-tuples/check requests.

So Keto always responded as expected or was there flaky behaviour? it sounds like it might be a bug in permission handling in your app rather than a flaky response from Keto?