[strantalis]

Proposed Changes

With caching disabled, use dynamic mappings from the targeted policy read for the definitions referenced by a decision. Remove the full dynamic-mapping, attribute, and subject-mapping scans from this decision path. The PDP configuration controls evaluation, including when mappings are present but the feature is disabled.

Cached decisions and entitlement enumeration retain full-policy reads. Registered resources and obligations remain outside this optimization.

Testing Instructions

Authorization race tests and changed-code lint pass, including disabled-feature cases, optional gates, inactive values, action/namespace mismatch, and mapping deduplication across batches. The previous rebased stack's CI scale run completed all 800 dynamic requests with zero failures: at concurrency 50, median 165 ms and p95 202 ms. The baseline timed out all 200 requests at that concurrency. These are individual CI runs; the RPC simplification still needs a fresh scale measurement.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	224.057495ms
Throughput	446.31 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	24.208648468s
Average Latency	241.696716ms
Throughput	206.54 requests/second

[github-actions]

X-Test Results

bats-test-results
✅ go@pull-4194-pull-4194
✅ go@main-main
✅ js@main-main
authorization-scale-report
cukes-report
✅ go@main-v0.9.0
govulncheck-failure-0
✅ js@main-v0.9.0
govulncheck-failure-2
opentdfplatformGHTJJ3.dockerbuild
✅ java@main-pull-4194
✅ go@pull-4194-v0.9.0
✅ go@pull-4194-main
govulncheck-failure-7
✅ java@main-v0.9.0
✅ go@main-pull-4194
✅ js@main-pull-4194
✅ java@main-main

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	403.106585ms
Throughput	248.07 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.561883s
Average Latency	444.728674ms
Throughput	112.20 requests/second

[github-actions]

X-Test Results

✅ go@pull-4194-v0.9.0
✅ go@main-v0.9.0
✅ java@main-main
✅ go@pull-4194-main
opentdfplatformOF6BJ2.dockerbuild
✅ java@main-pull-4194
✅ go@pull-4194-pull-4194
✅ js@main-pull-4194
✅ js@main-v0.9.0
govulncheck-failure-7
authorization-scale-report
✅ go@main-main
✅ java@main-v0.9.0
cukes-report
bats-test-results
✅ go@main-pull-4194
✅ js@main-main
govulncheck-failure-2
govulncheck-failure-0

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	235.301502ms
Throughput	424.99 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.463278531s
Average Latency	264.056541ms
Throughput	188.94 requests/second

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	315.462482ms
Throughput	316.99 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.466855156s
Average Latency	373.919765ms
Throughput	133.45 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-v0.9.0
cukes-report
✅ java@main-pull-4194
✅ go@main-main
✅ go@main-pull-4194
govulncheck-failure-2
✅ go@pull-4194-pull-4194
✅ java@main-v0.9.0
✅ js@main-main
✅ go@pull-4194-main
govulncheck-failure-7
opentdfplatformPXBGJ9.dockerbuild
✅ js@main-pull-4194
✅ js@main-v0.9.0
govulncheck-failure-0
✅ java@main-main
✅ go@pull-4194-v0.9.0

[strantalis]

This change is now included in #4192. GitHub automatically marked this PR merged into its parent branch during consolidation. #4192 remains the combined PR targeting main and includes the policy read, direct-entitlement and dynamic-mapping optimizations, and their tests.