fix(authz): reuse policy and entity resolution within bulk requests by strantalis · Pull Request #3990 · opentdf/platform

strantalis · 2026-09-05T11:32:16Z

Repeated entries in GetDecisionBulk fetch the same policy and resolve the same entity again. Reuse successful results within a sequential bulk RPC, bounded at eight policy sets and 32 entity resolutions.

Keys include normalized FQNs, the complete entity/token request, resource context, and environment-entity mode. Each RPC gets fresh tables; errors are not cached. This helps repeated bulk entries and does not reuse results across independent requests in the scale test.

Layer 3 of 4, based on #3989 and rebased on main at f992b60d.

Rebase verification (2026-10-05): all remaining patches are unchanged and based on main with #3987 merged. Authorization race tests, SDK README tests, formatting, and lint for the stack diff passed. Prior full repository check limitations are recorded in #3991.

coderabbitai · 2026-09-05T11:32:23Z

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-05T11:37:01Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	220.906729ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	115.681097ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	405.41829ms
Throughput	246.66 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.572117428s
Average Latency	414.538408ms
Throughput	120.27 requests/second

github-actions · 2026-09-05T11:46:27Z

X-Test Results

✅ go@main-main
bats-test-results
✅ go@pull-3990-v0.9.0
✅ go@main-v0.9.0
✅ java@main-main
✅ go@pull-3990-main
✅ go@pull-3990-pull-3990
cukes-report
✅ java@main-pull-3990
✅ go@main-pull-3990
✅ js@main-main
✅ java@main-v0.9.0
✅ js@main-v0.9.0
✅ js@main-pull-3990
opentdf~~platform~~R34QSR.dockerbuild
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-1

jakedoublev · 2026-09-08T21:29:08Z

I think this approach generally makes sense, but I think it's lower priority than some of the optimizations in the other layers of the stack.

github-actions · 2026-10-01T16:06:33Z

X-Test Failure Report

github-actions · 2026-10-01T16:10:34Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	133.744274ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	73.121205ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	283.413516ms
Throughput	352.84 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	32.018412009s
Average Latency	319.588855ms
Throughput	156.16 requests/second

github-actions · 2026-10-01T16:11:19Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	239.574719ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	141.274426ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	397.547271ms
Throughput	251.54 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.636573243s
Average Latency	445.351941ms
Throughput	112.02 requests/second

github-actions · 2026-10-01T16:20:12Z

X-Test Results

✅ go@main-main
✅ go@main-v0.9.0
✅ go@pull-3990-pull-3990
govulncheck-failure-3
✅ js@main-pull-3990
opentdf~~platform~~UV057U.dockerbuild
✅ java@main-v0.9.0
✅ go@main-pull-3990
✅ go@pull-3990-main
✅ java@main-main
✅ js@main-v0.9.0
bats-test-results
✅ java@main-pull-3990
govulncheck-failure-8
✅ go@pull-3990-v0.9.0
govulncheck-failure-1
✅ js@main-main

github-actions · 2026-10-01T21:03:46Z

X-Test Failure Report

github-actions · 2026-10-01T21:08:16Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	179.334819ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	95.428578ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	345.298705ms
Throughput	289.60 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	35.960134391s
Average Latency	358.679665ms
Throughput	139.04 requests/second

github-actions · 2026-10-01T21:08:21Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	236.138575ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	143.238411ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	410.786183ms
Throughput	243.44 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.562596258s
Average Latency	434.683844ms
Throughput	114.78 requests/second

github-actions · 2026-10-01T21:16:29Z

X-Test Results

✅ java@main-pull-3990
✅ go@pull-3990-v0.9.0
✅ js@main-pull-3990
✅ go@main-pull-3990
✅ js@main-v0.9.0
✅ go@pull-3990-pull-3990
✅ java@main-v0.9.0
govulncheck-failure-3
bats-test-results
authorization-scale-report
govulncheck-failure-1
✅ go@main-v0.9.0
✅ go@main-main
cukes-report
✅ java@main-main
✅ go@pull-3990-main
✅ js@main-main
govulncheck-failure-8
opentdf~~platform~~FGC820.dockerbuild

github-actions · 2026-10-01T22:11:05Z

X-Test Failure Report

github-actions · 2026-10-01T22:15:07Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	109.16811ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	55.31359ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	229.832958ms
Throughput	435.10 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	24.795012085s
Average Latency	247.227827ms
Throughput	201.65 requests/second

github-actions · 2026-10-01T22:16:59Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	246.800453ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	120.784469ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	397.019148ms
Throughput	251.88 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.72882461s
Average Latency	436.403452ms
Throughput	114.34 requests/second

github-actions · 2026-10-01T22:25:36Z

X-Test Results

✅ go@main-main
✅ go@main-pull-3990
cukes-report
✅ java@main-v0.9.0
✅ js@main-pull-3990
authorization-scale-report
✅ go@main-v0.9.0
govulncheck-failure-8
✅ java@main-pull-3990
✅ go@pull-3990-v0.9.0
✅ go@pull-3990-pull-3990
✅ js@main-main
govulncheck-failure-3
✅ java@main-main
opentdf~~platform~~RBJN15.dockerbuild
✅ go@pull-3990-main
bats-test-results
govulncheck-failure-1
✅ js@main-v0.9.0

github-actions · 2026-10-02T19:49:32Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	230.355285ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	119.083935ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	416.668898ms
Throughput	240.00 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.121377037s
Average Latency	430.008861ms
Throughput	115.95 requests/second

github-actions · 2026-10-02T19:57:58Z

X-Test Results

✅ go@pull-3990-pull-3990
✅ go@main-main
✅ go@pull-3990-v0.9.0
govulncheck-failure-8
✅ js@main-v0.9.0
✅ go@main-pull-3990
✅ go@pull-3990-main
✅ java@main-v0.9.0
✅ java@main-pull-3990
cukes-report
authorization-scale-report
govulncheck-failure-1
✅ js@main-pull-3990
✅ js@main-main
✅ go@main-v0.9.0
opentdf~~platform~~9445SX.dockerbuild
bats-test-results
govulncheck-failure-3
✅ java@main-main

github-actions · 2026-10-04T22:48:03Z

X-Test Failure Report

github-actions · 2026-10-04T22:52:14Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	254.581152ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	128.668438ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	418.217859ms
Throughput	239.11 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.87275369s
Average Latency	447.568471ms
Throughput	111.43 requests/second

github-actions · 2026-10-04T22:52:17Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	236.073496ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	134.972515ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	410.691088ms
Throughput	243.49 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.389039637s
Average Latency	442.714605ms
Throughput	112.64 requests/second

github-actions · 2026-10-04T23:00:41Z

X-Test Results

✅ go@main-main
✅ go@pull-3990-v0.9.0
✅ go@main-pull-3990
✅ java@main-pull-3990
✅ go@pull-3990-pull-3990
govulncheck-failure-1
opentdf~~platform~~WARQ5L.dockerbuild
✅ js@main-main
govulncheck-failure-3
✅ java@main-main
✅ js@main-pull-3990
✅ go@pull-3990-main
govulncheck-failure-8
✅ go@main-v0.9.0
cukes-report
bats-test-results
authorization-scale-report
✅ java@main-v0.9.0
✅ js@main-v0.9.0

github-actions · 2026-10-05T17:12:47Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	240.985632ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	123.077279ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	406.27679ms
Throughput	246.14 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.205438039s
Average Latency	431.22109ms
Throughput	115.73 requests/second

github-actions · 2026-10-05T17:20:55Z

X-Test Results

✅ go@main-pull-3990
✅ go@pull-3990-pull-3990
✅ go@main-v0.9.0
opentdf~~platform~~L6YV72.dockerbuild
✅ go@pull-3990-main
✅ js@main-main
✅ js@main-pull-3990
✅ java@main-main
✅ java@main-v0.9.0
✅ go@pull-3990-v0.9.0
bats-test-results
✅ js@main-v0.9.0
govulncheck-failure-3
✅ java@main-pull-3990
govulncheck-failure-1
✅ go@main-main
authorization-scale-report
govulncheck-failure-8

Signed-off-by: strantalis <strantalis@virtru.com>

github-actions · 2026-10-06T20:09:36Z

X-Test Failure Report

github-actions · 2026-10-06T20:14:14Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	418.224845ms
Throughput	239.11 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.545672811s
Average Latency	434.537373ms
Throughput	114.82 requests/second

github-actions · 2026-10-06T20:15:01Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	433.43271ms
Throughput	230.72 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	47.840602144s
Average Latency	477.405829ms
Throughput	104.51 requests/second

github-actions · 2026-10-06T20:16:12Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

otdfctl
service
tests-bdd

See the workflow run for details.

github-actions · 2026-10-06T20:22:34Z

X-Test Results

✅ js@main-pull-3990
authorization-scale-report
✅ go@pull-3990-pull-3990
✅ js@main-v0.9.0
✅ java@main-main
✅ go@main-pull-3990
cukes-report
✅ go@main-main
✅ java@main-pull-3990
bats-test-results
✅ js@main-main
✅ go@pull-3990-main
opentdf~~platform~~3TGHAY.dockerbuild
✅ java@main-v0.9.0
✅ go@pull-3990-v0.9.0
✅ go@main-v0.9.0
govulncheck-failure-0
govulncheck-failure-7
govulncheck-failure-2

github-actions Bot added size/m comp:authorization labels Sep 5, 2026

strantalis changed the title ~~perf(authz): reuse policy and entity resolution within bulk requests~~ fix(authz): reuse policy and entity resolution within bulk requests Sep 5, 2026

strantalis force-pushed the codex/authz-perf/bulk-reuse branch from 371ca30 to 4db2582 Compare October 1, 2026 16:06

strantalis mentioned this pull request Oct 1, 2026

fix(authz): reuse hierarchy and entity selector indexes #3991

Draft

strantalis force-pushed the codex/authz-perf/bulk-reuse branch from 4db2582 to 79b3d7c Compare October 1, 2026 21:03

strantalis removed this pull request from stack #3992 October 1, 2026 21:07

strantalis added this pull request to stack #4131 October 1, 2026 21:07

strantalis force-pushed the codex/authz-perf/bulk-reuse branch from 79b3d7c to e3ce12d Compare October 1, 2026 22:10

jakedoublev force-pushed the codex/authz-perf/bulk-reuse branch from e3ce12d to ed5fef8 Compare October 2, 2026 19:45

strantalis force-pushed the codex/authz-perf/bulk-reuse branch from ed5fef8 to d35dcca Compare October 4, 2026 22:47

strantalis force-pushed the codex/authz-perf/bulk-reuse branch from d35dcca to 7e6cf6a Compare October 5, 2026 17:08

perf(authz): reuse policy and entity resolution within bulk requests

ef264fc

Signed-off-by: strantalis <strantalis@virtru.com>

strantalis force-pushed the codex/authz-perf/bulk-reuse branch from 7e6cf6a to ef264fc Compare October 6, 2026 20:08

Conversation

strantalis commented Sep 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Draft PR not reviewed

Uh oh!

github-actions Bot commented Sep 5, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 5, 2026

X-Test Results

Uh oh!

jakedoublev commented Sep 8, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Results

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Results

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Results

Uh oh!

strantalis commented Sep 5, 2026 •

edited

Loading

coderabbitai Bot commented Sep 5, 2026 •

edited

Loading