Discussion with the team on whether we should use the PDP as a source for these audits? What about metadata?

• Implement RBAC's own access controls within SpiceDB with the relations API, then
• Use the PDP as an audit logger (anything integrated with PDP would get audit logger for free)
• Impact: Adjustment to API to be an actual replacement - not just checks, but successful actions (add, binding, etc.)

<From previous discussion>
- Possibility (pending spike): PDP endpoint as "audit logger" has been discussed, simple use case would be:

1) For UI enable to some options it will use PDP endpoint: "can user X create a clusteR" - this will result in UI enabling the "create cluster" button (probably no audit logging)

2) the action of user creating the cluster – clicks the button --OCM – PDP – allows cluster creation (requires audit logging)

Suggestion might be to start with a simple bool "auditlog" defaulting to "false" to start with in the request for PDP check

Output should include an ADR-type document for the decision the team is making.