bharos opened a new issue, #12758: URL: https://github.com/apache/gravitino/issues/12758
### Describe the proposal Let authorization read tags, so that classification can drive access. Today an organization that already labels tables `certified` or `pii` must still enumerate grants object by object: new objects need new grants, dropped objects leave stale ones, and the rule exists only as the accumulated set of grants someone remembered to issue. An access rule is a `Policy` of type `system_access_control` whose `content` carries an action, a role condition and a scope. The policy is bound to a tag; any object carrying that tag becomes subject to the rule. The role is a condition matched against the caller's expanded roles rather than a principal, and the rule composes with RBAC instead of replacing it. Design doc: #12757 (discussion #12619). Agreed so far: - One attachment — the policy-to-tag bind. Role and scope are values inside `content`, not associations. - `ALLOW` only in this version. - `USE_CATALOG` / `USE_SCHEMA` stay RBAC; tags do not grant traversal. - A typed `AccessControlContent` implementing `PolicyContent`, validated at write time. Open in the design doc, not yet decided: 1. Where tags are evaluated — expand at role load, or a second stage at request time. 2. Composition when a tag allows and RBAC denies. 3. What happens when a referenced role is deleted. 4. Whether object-scoped `APPLY_TAG` ships in this version. ### Task list - [ ] #12757 — design doc Further subtasks will be added once the open questions are resolved; the breakdown of the evaluation and list-filtering work depends on (1). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
