The SpiceDB KubeAPI Proxy is an open-sourced project that functions as a network proxy between a Kubernetes client and a cluster, presenting itself as a full-fledged kube-apiserver to clients. It utilizes SpiceDB to make decisions about how to forward requests to an upstream kube-apiserver, determining whether a request can proceed and how to filter responses. The proxy supports write requests, executing distributed transactions across SpiceDB and the Kube API, ensuring permissions data remains synchronized with the backing cluster. It maintains a durable log of operations and can be configured with rules that determine how to authorize requests and filter responses. The project was written to support Authzed Cloud's multi-tenant control plane management, providing fine-grained permissions to users. The Kubernetes authorization layer is modular, but this approach allows for validation of concepts in a production environment before suggesting methods for deeper integration.