roryqi opened a new pull request, #12177: URL: https://github.com/apache/gravitino/pull/12177
### What changes were proposed in this pull request? Add `design-docs/policy-on-tag.md`, a design document for the policy-on-tag governance model. The design covers: 1. Target model: `Policy -> Tag -> Metadata Object`. 2. Effective tag based object policy resolution. 3. Policy-to-tag relation storage. 4. REST and client API changes. 5. Authorization, visibility, and audit semantics. 6. Row filter and column mask conflict handling. 7. Tag value overwrite semantics. 8. TMS integration, migration, ABAC evolution, and task breakdown. ### Why are the changes needed? The current direct object policy model requires users to manage tags and policies separately on the same metadata object. This does not scale well for governance across catalogs, schemas, tables, and columns. Policy-on-tag aligns policy assignment with classification and provides a shared selection layer for TMS and future ABAC use cases. Fix: #12176 ### Does this PR introduce _any_ user-facing change? No code or API behavior changes. This is a design documentation-only change. ### How was this patch tested? - `git diff --cached --check` - `git diff --check apache/main...HEAD` - `./gradlew :docs:build` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
