Every system that asks SpiceDB a question ends up caching the reply — a gateway, a search index, a CDN. Watch is a stream of every relationship change as it happens, so those caches find out in milliseconds instead of on the next poll.
re-read everything every 5 seconds
A change can sit unnoticed for up to 5 seconds.
one open stream, pushed as it happens
Changes arrive in milliseconds.
Almost always the same one: a cached allow that outlives the permission it was based on. Run the chain.
Every service that caches a decision subscribes, and evicts the moment a relevant relationship changes.
DELETE document:revenue#viewer@user:bob → drop every cached answer involving Bob.
The common pattern attaches an allowed-document list to each user so the index can filter on it.
Watch keeps that list fresh. For AI retrieval this matters more than elsewhere: a document that reaches the model's context can leak through an answer without ever being quoted.
Publish the stream onward — to Kafka, a warehouse, an edge cache, a GraphQL gateway — so systems that cannot call SpiceDB per request still stay current.
Watch tells you what changed, not who can now see what. It emits relationship changes; working out the consequence is your consumer's job. And a stream is eventually consistent by nature — for a check that must reflect a write that just landed, pin the check to that write's token instead. The two solve different problems. This page is a browser-side illustration, not a benchmark.