fix(authz): scope uncached direct decisions to resource policy

[strantalis]

Proposed Changes

With caching disabled, enabling direct entitlements currently loads every attribute and subject mapping before a decision. Fetch the policy referenced by the request's resources through the PDP policy read from #4192.

Cached decisions and entitlement enumeration retain their full-policy path. Registered resources and obligations still load during construction.

Testing Instructions

Authorization race tests and changed-code lint pass, covering attribute rules, missing/inactive values, action mismatch, and cache/enumeration behavior. The previous rebased stack's CI scale run completed all 800 direct requests with zero failures: at concurrency 50, median 233 ms and p95 289 ms. The baseline timed out all 200 requests at that concurrency. These are individual CI runs; the RPC simplification still needs a fresh scale measurement.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	338.916396ms
Throughput	295.06 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	33.604128276s
Average Latency	335.213357ms
Throughput	148.79 requests/second

[github-actions]

X-Test Results

✅ go@pull-4193-v0.9.0
✅ java@main-main
✅ go@main-pull-4193
bats-test-results
✅ java@main-v0.9.0
✅ js@main-main
✅ java@main-pull-4193
✅ go@pull-4193-main
✅ go@main-main
govulncheck-failure-7
✅ js@main-v0.9.0
cukes-report
✅ js@main-pull-4193
✅ go@main-v0.9.0
govulncheck-failure-0
✅ go@pull-4193-pull-4193
govulncheck-failure-2
opentdfplatformPUJ6EB.dockerbuild

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	428.22348ms
Throughput	233.52 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.145199999s
Average Latency	440.254381ms
Throughput	113.26 requests/second

[github-actions]

X-Test Results

✅ go@pull-4193-v0.9.0
✅ go@main-v0.9.0
✅ go@main-pull-4193
cukes-report
✅ go@main-main
opentdfplatformOUN53D.dockerbuild
govulncheck-failure-2
✅ go@pull-4193-main
bats-test-results
✅ js@main-main
✅ java@main-pull-4193
✅ java@main-v0.9.0
govulncheck-failure-0
govulncheck-failure-7
✅ js@main-pull-4193
✅ js@main-v0.9.0
✅ java@main-main
✅ go@pull-4193-pull-4193

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	454.268903ms
Throughput	220.13 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.888138462s
Average Latency	438.0023ms
Throughput	113.93 requests/second

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	433.458922ms
Throughput	230.70 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.802147562s
Average Latency	496.944933ms
Throughput	100.40 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ js@main-main
✅ go@main-main
✅ go@main-pull-4193
✅ js@main-pull-4193
✅ java@main-pull-4193
✅ go@pull-4193-pull-4193
govulncheck-failure-0
✅ go@main-v0.9.0
✅ java@main-v0.9.0
✅ go@pull-4193-main
opentdfplatformXWAUB0.dockerbuild
govulncheck-failure-2
✅ go@pull-4193-v0.9.0
bats-test-results
✅ java@main-main
govulncheck-failure-7
cukes-report
✅ js@main-v0.9.0

[strantalis]

This change is now included in #4192. GitHub automatically marked this PR merged into its parent branch during consolidation. #4192 remains the combined PR targeting main and includes the policy read, direct-entitlement and dynamic-mapping optimizations, and their tests.