bharos opened a new issue, #13908: URL: https://github.com/apache/gravitino/issues/13908
### Describe the subtask Binds and tag applications made during M1 predate the authority checks added in M2.1. The feature flag decides when tag-derived access takes effect, not whether it was ever allowed, so turning it on grants everything authored while it was off. From M2.1 onwards every bind is authorized as it is made. What already exists was not, so M2 has to validate it. What lands: - A validation pass over existing policy-to-tag bindings and tag applications, checking them against the M2.1 authority rules. - A decision on what happens to the ones that fail. The design doc does not specify this, and it needs settling on this issue before the pass is written. Must land before the feature flag in M3.3 is turned on. Blocked on M2.1, which defines the rules this validates against. ### Parent issue #12758 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
