bharos opened a new issue, #13906: URL: https://github.com/apache/gravitino/issues/13906
### Describe the subtask M1 in the tag-based access control design doc (#12757) has three deliverables. The first two landed in #13511 and #13901 under #13510, which closed automatically when the first of them merged. This is the third. What lands: - An indexed join row per referenced role, written by the server on policy create and update, in the same shape as the existing `tag_relation_meta` and `policy_relation_meta` tables. - The record is derived from `content` and not user-writable: no endpoint touches it. `content` stays authoritative, and a record that disagrees with it is rebuilt. - The record carries role names, since that is what `content` holds. Role names live inside `content`, a JSON column. Answering "which policies reference `analyst`" by scanning and parsing every policy in the metalake does not scale, and role deletion needs that answer. Blocks M6 role deletion. Rests on OQ-3, which is decided. ### Parent issue #12758 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
