fix(authz): reuse compiled policy snapshots by strantalis · Pull Request #3988 · opentdf/platform

strantalis · 2026-09-05T11:32:09Z

Compile registered-resource and obligation indexes once per JIT PDP. When the optional policy cache is enabled, publish raw policy and compiled indexes as one immutable snapshot, coalesce successful cold loads, and retain the previous snapshot after a failed refresh.

Caching stays disabled by default. Enabled deployments see policy changes after successful refreshes. Experimental direct entitlements and dynamic mappings retain their full-policy fallback; this PR does not make those paths decision-scoped.

Layer 1 of 4, rebased onto main at f992b60d.

Rebase verification (2026-10-05): all remaining patches are unchanged and based on main with #3987 merged. Authorization race tests, SDK README tests, formatting, and lint for the stack diff passed. Prior full repository check limitations are recorded in #3991.

coderabbitai · 2026-09-05T11:32:16Z

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-05T11:36:49Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	175.497811ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.944084ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	346.911259ms
Throughput	288.26 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.684180442s
Average Latency	376.059675ms
Throughput	132.68 requests/second

github-actions · 2026-09-05T11:45:33Z

X-Test Results

✅ go@pull-3988-pull-3988
✅ go@main-pull-3988
✅ go@main-main
✅ go@pull-3988-main
✅ go@main-v0.9.0
✅ go@pull-3988-v0.9.0
bats-test-results
cukes-report
✅ js@main-pull-3988
✅ js@main-main
✅ java@main-pull-3988
✅ java@main-v0.9.0
✅ java@main-main
✅ js@main-v0.9.0
opentdf~~platform~~G3KMIE.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1

github-actions · 2026-10-01T16:06:36Z

X-Test Failure Report

github-actions · 2026-10-01T16:11:41Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	172.811784ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	97.962457ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	343.038739ms
Throughput	291.51 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.423174912s
Average Latency	393.287307ms
Throughput	126.83 requests/second

github-actions · 2026-10-01T16:11:44Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	225.99042ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	142.672338ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	433.82606ms
Throughput	230.51 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.588551077s
Average Latency	454.825507ms
Throughput	109.68 requests/second

github-actions · 2026-10-01T16:20:38Z

X-Test Results

✅ js@main-pull-3988
✅ go@main-v0.9.0
bats-test-results
✅ go@main-pull-3988
✅ go@pull-3988-main
govulncheck-failure-1
✅ java@main-v0.9.0
✅ java@main-main
govulncheck-failure-8
govulncheck-failure-3
opentdf~~platform~~S80YGO.dockerbuild
✅ go@pull-3988-v0.9.0
✅ go@main-main
✅ java@main-pull-3988
✅ go@pull-3988-pull-3988
✅ js@main-v0.9.0
cukes-report
✅ js@main-main

github-actions · 2026-10-01T21:03:47Z

X-Test Failure Report

github-actions · 2026-10-01T21:07:20Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	157.089317ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	80.576011ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	275.586977ms
Throughput	362.86 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	29.075556545s
Average Latency	290.059585ms
Throughput	171.97 requests/second

github-actions · 2026-10-01T21:08:06Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	191.665047ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	102.40329ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	391.757601ms
Throughput	255.26 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.499213639s
Average Latency	374.352394ms
Throughput	133.34 requests/second

github-actions · 2026-10-01T21:17:01Z

X-Test Failure Report

✅ go@pull-3988-v0.9.0
✅ java@main-v0.9.0
opentdf~~platform~~NXNE87.dockerbuild
✅ go@pull-3988-main
bats-test-results
✅ go@main-pull-3988
server-logs-go@main-main
authorization-scale-report
✅ go@pull-3988-pull-3988
cukes-report
govulncheck-failure-8
✅ js@main-main
✅ java@main-main
✅ go@main-v0.9.0
✅ java@main-pull-3988
✅ js@main-v0.9.0
govulncheck-failure-3
✅ js@main-pull-3988
govulncheck-failure-1

github-actions · 2026-10-01T22:11:06Z

X-Test Failure Report

github-actions · 2026-10-01T22:15:53Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	242.219754ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	134.91161ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	423.75266ms
Throughput	235.99 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	46.049629977s
Average Latency	459.138047ms
Throughput	108.58 requests/second

github-actions · 2026-10-01T22:15:58Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	218.428783ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	131.675078ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	408.545471ms
Throughput	244.77 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.802030554s
Average Latency	437.105616ms
Throughput	114.15 requests/second

github-actions · 2026-10-01T22:25:25Z

X-Test Results

✅ go@main-pull-3988
✅ java@main-main
✅ go@main-main
✅ js@main-pull-3988
✅ js@main-v0.9.0
✅ js@main-main
cukes-report
govulncheck-failure-8
✅ go@main-v0.9.0
✅ go@pull-3988-v0.9.0
✅ java@main-v0.9.0
govulncheck-failure-1
govulncheck-failure-3
✅ go@pull-3988-pull-3988
authorization-scale-report
bats-test-results
✅ java@main-pull-3988
✅ go@pull-3988-main
opentdf~~platform~~KEQM65.dockerbuild

github-actions · 2026-10-02T19:49:24Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	233.105026ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	127.274958ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	419.566703ms
Throughput	238.34 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.487549339s
Average Latency	453.216618ms
Throughput	109.92 requests/second

github-actions · 2026-10-02T19:57:19Z

X-Test Results

✅ go@pull-3988-main
bats-test-results
✅ java@main-v0.9.0
✅ go@main-pull-3988
✅ go@pull-3988-pull-3988
✅ go@main-v0.9.0
govulncheck-failure-3
✅ go@main-main
✅ js@main-pull-3988
✅ js@main-main
govulncheck-failure-1
✅ java@main-pull-3988
opentdf~~platform~~6108YM.dockerbuild
authorization-scale-report
✅ js@main-v0.9.0
✅ java@main-main
✅ go@pull-3988-v0.9.0
govulncheck-failure-8

github-actions · 2026-10-04T22:48:14Z

X-Test Failure Report

github-actions · 2026-10-04T22:51:39Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	157.445788ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	94.039005ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	340.606924ms
Throughput	293.59 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	34.195532933s
Average Latency	341.062261ms
Throughput	146.22 requests/second

github-actions · 2026-10-04T22:51:57Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	242.848317ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	134.999226ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	416.776767ms
Throughput	239.94 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	46.76505577s
Average Latency	466.828042ms
Throughput	106.92 requests/second

github-actions · 2026-10-04T23:00:56Z

X-Test Results

✅ go@pull-3988-pull-3988
cukes-report
✅ js@main-v0.9.0
✅ js@main-pull-3988
✅ js@main-main
✅ go@pull-3988-v0.9.0
authorization-scale-report
✅ go@main-pull-3988
✅ java@main-main
govulncheck-failure-1
✅ go@main-main
✅ java@main-v0.9.0
govulncheck-failure-3
✅ go@pull-3988-main
bats-test-results
✅ go@main-v0.9.0
✅ java@main-pull-3988
opentdf~~platform~~UPJXF7.dockerbuild
govulncheck-failure-8

github-actions · 2026-10-05T17:12:45Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	245.522284ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	129.014093ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	415.594334ms
Throughput	240.62 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	46.588264227s
Average Latency	464.967481ms
Throughput	107.32 requests/second

github-actions · 2026-10-05T17:21:11Z

X-Test Results

✅ go@pull-3988-main
✅ js@main-v0.9.0
✅ java@main-main
✅ java@main-pull-3988
✅ java@main-v0.9.0
authorization-scale-report
✅ go@main-v0.9.0
bats-test-results
✅ js@main-main
govulncheck-failure-1
govulncheck-failure-8
cukes-report
✅ go@main-main
opentdf~~platform~~H1FNS9.dockerbuild
✅ go@pull-3988-v0.9.0
✅ go@pull-3988-pull-3988
✅ go@main-pull-3988
✅ js@main-pull-3988
govulncheck-failure-3

Signed-off-by: strantalis <strantalis@virtru.com>

github-actions · 2026-10-06T20:14:00Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	384.721709ms
Throughput	259.93 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.419281845s
Average Latency	403.118269ms
Throughput	123.70 requests/second

github-actions · 2026-10-06T20:16:53Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

otdfctl
service
tests-bdd

See the workflow run for details.

github-actions · 2026-10-06T20:23:54Z

X-Test Results

✅ go@main-main
✅ js@main-pull-3988
✅ java@main-v0.9.0
✅ go@pull-3988-main
govulncheck-failure-7
authorization-scale-report
✅ js@main-v0.9.0
✅ java@main-pull-3988
✅ go@pull-3988-pull-3988
bats-test-results
✅ go@main-pull-3988
✅ go@main-v0.9.0
cukes-report
✅ go@pull-3988-v0.9.0
✅ js@main-main
opentdf~~platform~~TEM7MV.dockerbuild
✅ java@main-main
govulncheck-failure-0
govulncheck-failure-2

github-actions Bot added comp:authorization docs Documentation size/l labels Sep 5, 2026

strantalis changed the title ~~codex/authz perf/prepared policy~~ perf(authz): reuse compiled policy snapshots Sep 5, 2026

strantalis changed the title ~~perf(authz): reuse compiled policy snapshots~~ fix(authz): reuse compiled policy snapshots Sep 5, 2026

strantalis force-pushed the codex/authz-perf/prepared-policy branch from 09162da to 5bdfffb Compare October 1, 2026 16:06

strantalis mentioned this pull request Oct 1, 2026

fix(authz): bound retries for missing attribute values #3989

Draft

strantalis force-pushed the codex/authz-perf/prepared-policy branch from 5bdfffb to f2cb360 Compare October 1, 2026 21:03

strantalis removed this pull request from stack #3992 October 1, 2026 21:07

strantalis added this pull request to stack #4131 October 1, 2026 21:07

strantalis force-pushed the codex/authz-perf/prepared-policy branch from f2cb360 to e0cde45 Compare October 1, 2026 22:10

jakedoublev force-pushed the codex/authz-perf/prepared-policy branch from e0cde45 to bae7dff Compare October 2, 2026 19:45

strantalis force-pushed the codex/authz-perf/prepared-policy branch from bae7dff to 52b89d8 Compare October 4, 2026 22:47

Base automatically changed from codex/authz-perf/immutable-policy to main October 5, 2026 17:08

strantalis force-pushed the codex/authz-perf/prepared-policy branch from 52b89d8 to 1653b12 Compare October 5, 2026 17:08

strantalis added 2 commits October 6, 2026 16:06

perf(authz): reuse compiled policy snapshots

3f9b3f6

Signed-off-by: strantalis <strantalis@virtru.com>

docs(authz): preserve configuration table formatting

3f09069

Signed-off-by: strantalis <strantalis@virtru.com>

strantalis force-pushed the codex/authz-perf/prepared-policy branch from 1653b12 to 3f09069 Compare October 6, 2026 20:08

Conversation

strantalis commented Sep 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Draft PR not reviewed

Uh oh!

github-actions Bot commented Sep 5, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 5, 2026

X-Test Results

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Results

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Results

Uh oh!

github-actions Bot commented Oct 2, 2026

Benchmark authorization.GetDecisions Results:

strantalis commented Sep 5, 2026 •

edited

Loading

coderabbitai Bot commented Sep 5, 2026 •

edited

Loading