bharos opened a new issue, #13907: URL: https://github.com/apache/gravitino/issues/13907
### Describe the subtask Implement the authority checks from OQ-4 in the tag-based access control design doc (#12757). Three write paths confer access today without one. What lands: - Applying an access-carrying tag to an object requires `MANAGE_GRANTS` or ownership on the object or an ancestor, plus an explicit grant of `APPLY_TAG` on that tag. - Binding a policy to an already-applied tag requires metalake ownership or `CREATE_POLICY` at the metalake. - Widening a bound policy's `content` requires the same authority as binding. This must land before the feature flag in M3.3 is turned on, or all three paths confer access unchecked. Independent of where tags are evaluated, so it can proceed in parallel with M3. Rests on OQ-4, which is decided. Validating the binds and tag applications made during M1, before these checks existed, is tracked separately and is not in scope here. ### Parent issue #12758 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
