diff --git a/pkg/services/authz/zanzana/client/client.go b/pkg/services/authz/zanzana/client/client.go
index 85c92a170e6..964b00d7724 100644
--- a/pkg/services/authz/zanzana/client/client.go
+++ b/pkg/services/authz/zanzana/client/client.go
@@ -3,12 +3,12 @@ package client
 import (
 	"context"
 
+	authzlib "github.com/grafana/authlib/authz"
 	authzv1 "github.com/grafana/authlib/authz/proto/v1"
 	authlib "github.com/grafana/authlib/types"
 	"go.opentelemetry.io/otel"
 	"google.golang.org/grpc"
 
-	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	"github.com/grafana/grafana/pkg/infra/log"
 	authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
 )
@@ -18,16 +18,19 @@ var _ authlib.AccessClient = (*Client)(nil)
 var tracer = otel.Tracer("github.com/grafana/grafana/pkg/services/authz/zanzana/client")
 
 type Client struct {
-	logger   log.Logger
-	authz    authzv1.AuthzServiceClient
-	authzext authzextv1.AuthzExtentionServiceClient
+	logger         log.Logger
+	authz          authzv1.AuthzServiceClient
+	authzext       authzextv1.AuthzExtentionServiceClient
+	authzlibclient *authzlib.ClientImpl
 }
 
 func New(cc grpc.ClientConnInterface) (*Client, error) {
+	authzlibclient := authzlib.NewClient(cc, authzlib.WithTracerClientOption(tracer))
 	c := &Client{
-		authz:    authzv1.NewAuthzServiceClient(cc),
-		authzext: authzextv1.NewAuthzExtentionServiceClient(cc),
-		logger:   log.New("zanzana-client"),
+		authzlibclient: authzlibclient,
+		authz:          authzv1.NewAuthzServiceClient(cc),
+		authzext:       authzextv1.NewAuthzExtentionServiceClient(cc),
+		logger:         log.New("zanzana-client"),
 	}
 
 	return c, nil
@@ -37,69 +40,14 @@ func (c *Client) Check(ctx context.Context, id authlib.AuthInfo, req authlib.Che
 	ctx, span := tracer.Start(ctx, "authlib.zanzana.client.Check")
 	defer span.End()
 
-	res, err := c.authz.Check(ctx, &authzv1.CheckRequest{
-		Subject:     id.GetUID(),
-		Verb:        req.Verb,
-		Group:       req.Group,
-		Resource:    req.Resource,
-		Namespace:   req.Namespace,
-		Name:        req.Name,
-		Subresource: req.Subresource,
-		Path:        req.Path,
-		Folder:      req.Folder,
-	})
-
-	if err != nil {
-		return authlib.CheckResponse{}, err
-	}
-
-	return authlib.CheckResponse{Allowed: res.GetAllowed()}, nil
+	return c.authzlibclient.Check(ctx, id, req)
 }
 
 func (c *Client) Compile(ctx context.Context, id authlib.AuthInfo, req authlib.ListRequest) (authlib.ItemChecker, error) {
 	ctx, span := tracer.Start(ctx, "authlib.zanzana.client.Compile")
 	defer span.End()
 
-	res, err := c.authz.List(ctx, &authzv1.ListRequest{
-		Subject:   id.GetUID(),
-		Group:     req.Group,
-		Verb:      utils.VerbList,
-		Resource:  req.Resource,
-		Namespace: req.Namespace,
-	})
-
-	if err != nil {
-		return nil, err
-	}
-
-	return newItemChecker(res), nil
-}
-
-func newItemChecker(res *authzv1.ListResponse) authlib.ItemChecker {
-	// if we can see all resource of this type we can just return a function that always return true
-	if res.GetAll() {
-		return func(_, _ string) bool { return true }
-	}
-
-	folders := make(map[string]struct{}, len(res.Folders))
-	for _, f := range res.Folders {
-		folders[f] = struct{}{}
-	}
-
-	items := make(map[string]struct{}, len(res.Items))
-	for _, i := range res.Items {
-		items[i] = struct{}{}
-	}
-
-	return func(name, folder string) bool {
-		if _, ok := items[name]; ok {
-			return true
-		}
-		if _, ok := folders[folder]; ok {
-			return true
-		}
-		return false
-	}
+	return c.authzlibclient.Compile(ctx, id, req)
 }
 
 func (c *Client) Read(ctx context.Context, req *authzextv1.ReadRequest) (*authzextv1.ReadResponse, error) {
diff --git a/pkg/services/authz/zanzana/client/shadow_client.go b/pkg/services/authz/zanzana/client/shadow_client.go
index 9e71332ef88..16dacfd5029 100644
--- a/pkg/services/authz/zanzana/client/shadow_client.go
+++ b/pkg/services/authz/zanzana/client/shadow_client.go
@@ -51,7 +51,7 @@ func (c *ShadowClient) Check(ctx context.Context, id authlib.AuthInfo, req authl
 		if acErr == nil {
 			if res.Allowed != acRes.Allowed {
 				c.metrics.evaluationStatusTotal.WithLabelValues("error").Inc()
-				c.logger.Warn("Zanzana check result does not match", "expected", acRes.Allowed, "actual", res.Allowed)
+				c.logger.Warn("Zanzana check result does not match", "expected", acRes.Allowed, "actual", res.Allowed, "user", id.GetUID(), "request", req)
 			} else {
 				c.metrics.evaluationStatusTotal.WithLabelValues("success").Inc()
 			}
@@ -99,7 +99,7 @@ func (c *ShadowClient) Compile(ctx context.Context, id authlib.AuthInfo, req aut
 			zanzanaRes := zanzanaItemChecker(name, folder)
 			if zanzanaRes != rbacRes {
 				c.metrics.evaluationStatusTotal.WithLabelValues("error").Inc()
-				c.logger.Warn("Zanzana compile result does not match", "expected", rbacRes, "actual", zanzanaRes)
+				c.logger.Warn("Zanzana compile result does not match", "expected", rbacRes, "actual", zanzanaRes, "name", name, "folder", folder)
 			} else {
 				c.metrics.evaluationStatusTotal.WithLabelValues("success").Inc()
 			}