SpiceDB 1.56

Use these rules for SpiceDB 1.56 authorization schemas, v1 API integrations, caveats, relationship expiration, datastores, and deployment. SpiceDB evaluates authorization; the application supplies authenticated identities and enforces the result.

Version and runtime scope

• Run the newest official SpiceDB release, because SpiceDB's security policy assumes the latest release. Verify the binary's or container's integrity, reference the image by a digest an update bot maintains, keep debug images out of production, and take any exact version from the SpiceDB releases page or leave a placeholder that fails the build rather than a version you remember.
• Use a Go toolchain satisfying the tagged go.mod minimum of the release you compile or embed, which is Go 1.26.6 for v1.56.1. A distributed SpiceDB binary does not require a separately installed Go runtime; client SDK runtime requirements are independent.
• Select a durable production datastore explicitly with --datastore-engine; reserve the default memory engine and serve-testing for development and tests. Supported persistent engines are postgres, cockroachdb, mysql, and spanner.
• Validate opt-in --experimental-query-plan, --experimental-lookup-resources-version, and --experimental-schema-mode changes against this binary, schema, and datastore before rollout; do not assume experimental execution paths have identical operational behavior.

Service authentication and transport

• Expose SpiceDB only to trusted backend services on a segregated network. Put application authentication, method