bharos opened a new issue, #13910: URL: https://github.com/apache/gravitino/issues/13910
### Describe the subtask Implement the matching component of M3 in the tag-based access control design doc (#12757). A deterministic evaluator takes the requested privilege, the active role set, and the resolved tags and enabled policies. It returns a match or no match, with the matching tag and policy identifiers. It performs no storage reads, no role expansion and no cache mutation, and has no dependency on REST or jCasbin. The result is internal evidence, not a new public authorization decision or API. Unit tests cover: - multiple privileges, and any matching active role; - no match for inactive roles or `ActiveRoles.none()`; - same-name nearest-wins overrides and different-name inheritance; - `ALL_VALUES` and value-sensitive selectors; - disabled policies and absent bindings. Blocked on the first PR of M3.1, which defines the resolved representation this consumes. ### Parent issue #12758 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
