bharos opened a new issue, #11967: URL: https://github.com/apache/gravitino/issues/11967
### Describe the subtask When active roles are declared, evaluate allow policies against only those roles instead of the caller's full role union. Deny evaluation and deny-based list short-circuits continue to use the full role set, so a deny on any held role still applies regardless of the active set. Ownership checks are unchanged. Includes unit tests for allow-narrowing, deny-stays-global, `NONE`, and group-inherited roles. ### Parent issue #11965 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
