bharos opened a new pull request, #12757:
URL: https://github.com/apache/gravitino/pull/12757
### What changes were proposed in this pull request?
Adds `design-docs/tag-based-access-control.md`, a design for expressing
access rules as tag-bound policies.
An access rule is a `Policy` of type `system_access_control` whose `content`
carries an `action`, a `role` condition and a `scope`. The policy is bound to a
tag; any object carrying that tag becomes subject to the rule. There is one
attachment — the policy-to-tag bind — and no new user-facing entity, REST
resource or client API.
```json
POST /api/metalakes/prod/policies
{
"name": "analyst_read_certified_finance",
"policyType": "system_access_control",
"enabled": true,
"content": {
"action": "SELECT_TABLE",
"role": { "name": "analyst" },
"scope": { "catalog": "lakehouse", "schema": "finance" }
}
}
```
```
PUT
/api/metalakes/prod/tags/certified/policies/analyst_read_certified_finance
{ "selector": { "type": "ALL_VALUES" } }
POST /api/metalakes/prod/objects/TABLE/lakehouse.finance.orders/tags
{ "tagsToAdd": [{ "name": "certified" }] }
```
The doc covers the `AccessControlContent` schema and its `validate()`,
evaluation and cache freshness, composition with RBAC, the administration
surface, and lifecycle.
### Why are the changes needed?
Authorization does not read tags today, so classification cannot drive
access. An organization that already labels tables `certified` or `pii` must
still enumerate grants object by object: new objects need new grants, dropped
objects leave stale ones, and the rule exists only as the accumulated set of
grants someone remembered to issue.
This follows the discussion in #12619 and reflects the model agreed there.
Four questions are deliberately left open for review rather than decided in
this revision, each presented with its options:
1. **Where tags are evaluated** — expand into JCasbin rows when roles load,
or evaluate as a second stage at request time.
2. **Composition when a tag allows and RBAC denies** — deny wins, or refuse
the overlap.
3. **What happens when a referenced role is deleted** — leave dangling,
refuse the deletion, delete the policies, or disable them. This also settles
whether `validate()` requires the role to exist at creation.
4. **Whether object-scoped `APPLY_TAG` ships in this version** —
`ApplyTag.canBindTo` accepts only `METALAKE` and `TAG` today.
Discussion: #12619
### Does this PR introduce _any_ user-facing change?
No. Documentation only.
### How was this patch tested?
Not applicable — no code changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
