bharos opened a new pull request, #11790: URL: https://github.com/apache/gravitino/pull/11790
### What changes were proposed in this pull request? Adds a design doc at `design-docs/gravitino-role-assumption.md` proposing **role assumption (SET ROLE)** — letting a caller narrow the active role set for a request via an `X-Gravitino-Active-Role` header. The narrowing is **subtractive-only** (validated against the caller's roles; can never escalate) and applies consistently across access checks, list filtering, and credential vending on the native authorization path (Iceberg REST + native Gravitino API). The doc covers the header grammar, how the server enforces narrowing on the existing Casbin model without a model change, transport per engine (Spark works today, Trino needs a small setting), security/trust boundaries (cooperative header vs. token-bound), prior art (Snowflake/Hive/Postgres), options considered, and a phased rollout. ### Why are the changes needed? A workload that only needs a few tables still runs with everything its identity can reach; misbehavior fails *open* and silent. Role assumption gives workloads (and AI agents) real runtime least-privilege and a clean audit signal, and restores `SET ROLE` parity for teams migrating Hive SQL-Standard-Auth tables to Iceberg behind Gravitino. This is a **proposal for discussion** (Status: Draft). Key open decisions are listed in §12 — most importantly the ownership-vs-narrowing semantics (§5). Feedback welcome inline. Discussion: apache/gravitino#10894 ### Does this PR introduce _any_ user-facing change? No — documentation only. ### How was this patch tested? N/A — design document only. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
