roryqi opened a new issue, #13692: URL: https://github.com/apache/gravitino/issues/13692
### Describe the subtask Implement the policy-model slice of the tag-based Iceberg read-restriction design in #13546. The scope includes: - Add the built-in `system_row_filter` and `system_column_mask` policy types. - Define distinct typed policy content for row filters and column masks. - Store exactly one restricted Rego `expression` in each policy. - Support policy creation, updates, REST serialization, DTO conversion, and persisted-content round trips. - Validate that expressions are non-blank and no larger than 16 KiB in UTF-8. - Reject content that does not match its built-in policy type and reject the obsolete `rules` representation. - Add unit tests for validation, serialization, conversion, and content-type enforcement. Expression parsing, subject/schema binding, policy resolution, and Iceberg REST enforcement are outside this subtask. ### Parent issue https://github.com/apache/gravitino/issues/13545 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
