Self-guided, hands-on workshops for fine-grained authorization with SpiceDB. Each one runs locally, builds something real, and ends with working code. Pick one and start.
| Workshop | What you build | Stack |
|---|---|---|
| Building Authorization for Agentic RAG Systems | Watch an agentic RAG leak documents across departments, then add a SpiceDB permission check the agent can't bypass. | SpiceDB, Milvus, LangGraph, OpenAI, Docker |
| Delegated Authorization for AI Agents | Give a DevOps deploy agent scoped, delegated permissions: time-bound grants that expire on their own, instant revocation, and a permission hierarchy. | SpiceDB, goose, Python, Docker |
| Secure Your RAG Pipelines (Pre-Filter & Post-Filter) | Stop a RAG pipeline leaking two ways, post-filter and pre-filter, compared live with a toggle, then add bulk checks and self-expiring grants. | SpiceDB, Qdrant, fastembed, LangGraph, Docker |
| Update a Web View Based on Permissions | Render an admin dashboard whose UI changes with the viewer's permissions. | SpiceDB, Next.js, TypeScript |
| Zero to Permissions System in 10 Minutes with MCP | Build and reason about an authorization model using AuthZed's Model Context Protocol (MCP) servers. | SpiceDB, AuthZed, MCP |
Secure Your RAG Pipelines also has an older notebook-based variant (DeepSeek R1 via OpenRouter, Pinecone, OpenAI embeddings) on a separate branch.
Start with Secure Your RAG Pipelines or Building Authorization for Agentic RAG Systems. Both open with a working app that leaks data, so you see the problem before you fix it. No prior authorization background is assumed; comfort with a terminal, Python, and Docker is enough.
To update or contribute to a workshop, open a pull request with a clear description of your changes.