bharos opened a new issue, #13909: URL: https://github.com/apache/gravitino/issues/13909
### Describe the subtask Implement the resolution component of M3 in the tag-based access control design doc (#12757). M3 separates evaluation into resolution, matching and composition, each with explicit inputs, so that each can be tested on its own. What lands: - An injectable reader for tag assignments and policy bindings. - Nearest-wins inheritance resolution, producing the same resolved representation for point checks and list preloads. - One resolution per object per request despite repeated privilege checks, including the case where an ancestor value is overridden at the target. The RBAC ancestor walk must not restore the overridden value. Storage failures are errors, not empty policy sets. An evaluation error cannot grant tag-derived access. Unit tests supply an in-memory hierarchy and bindings, with no catalog or database. The first PR on this subtask defines the reader interface and the resolved representation. M3.2 matching and M3.3 composition both consume them, so that PR is a contract and will be reviewed as one. Independent of M2, so it can proceed in parallel. Rests on OQ-1, which is decided. ### Parent issue #12758 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
