feat(authz): access pdp v2 with actions #2264

jakedoublev · 2025-05-20T19:53:16Z

Proposed Changes

PDP which assumes all entitlement policy has been provided to it
- unblocks embedding a PDP in services
- unblocks utilization of the PDP library as a playground
- decouples how the entity/policy are retrieved as totally distinct from the entity/policy being decisioned/entitled with the JustInTimePDP
Tests
Out of scope (will be handled separately):
- debug/audit logging parity with auth v1
- full unification of return types between access PDP and auth service protos
- named errors

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

github-actions · 2025-05-20T19:57:43Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	1.0395421s

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	378.254355ms
Throughput	264.37 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m20.08763753s
Average Latency	798.363339ms
Throughput	62.43 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4940
Failed Requests	60
Concurrent Requests	50
Total Time	1m11.405015356s
Average Latency	711.468215ms
Throughput	69.18 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	60 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-05-20T19:59:00Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	449.528219ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	374.108376ms
Throughput	267.30 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m24.342304997s
Average Latency	841.398163ms
Throughput	59.28 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4946
Failed Requests	54
Concurrent Requests	50
Total Time	1m14.088695148s
Average Latency	737.455936ms
Throughput	66.76 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	54 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-05-20T21:49:16Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	458.74126ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	367.619061ms
Throughput	272.02 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m18.879628192s
Average Latency	786.632946ms
Throughput	63.39 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4948
Failed Requests	52
Concurrent Requests	50
Total Time	1m9.49246925s
Average Latency	691.11459ms
Throughput	71.20 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	52 occurrences

Standard Benchmark Metrics Skipped or Failed

Copilot

Pull Request Overview

This PR introduces a new Policy Decision Point (PDP) v2 implementation with just-in-time fetching of policy and subject mappings, along with input validators and helper functions to support entitlement decisions.

Add validation functions for PDP inputs.
Implement in-memory PolicyDecisionPoint and JustInTimePDP wrappers.
Provide helper methods for attribute definition lookup, filtering, and hierarchy handling.

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
service/internal/access/v2/validators.go	Added functions to validate inputs for decision and resource calls
service/internal/access/v2/pdp.go	Core in-memory PDP implementation and decision flow
service/internal/access/v2/just_in_time_pdp.go	`JustInTimePDP` fetching remote policy, wrapping in-memory PDP
service/internal/access/v2/helpers.go	Helpers for parsing FQNs, filtering entitleable attributes, and hierarchy population
service/internal/access/v2/evaluate.go	Evaluation engine for resource decisions and rule implementations
service/internal/access/v2/errors.go	Defined error variables for PDP v2

Comments suppressed due to low confidence (1)

service/internal/access/v2/pdp.go:21

[nitpick] The JSON tag entity_rule_result is singular but maps to a slice. Consider renaming it to a plural form like entity_rule_results for clarity.

Results []ResourceDecision `json:"entity_rule_result"`

service/internal/access/v2/helpers.go

service/internal/access/v2/just_in_time_pdp.go

github-actions · 2025-05-20T22:11:54Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	468.268106ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	376.267836ms
Throughput	265.77 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m21.560412203s
Average Latency	812.153337ms
Throughput	61.30 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4959
Failed Requests	41
Concurrent Requests	50
Total Time	1m12.092448408s
Average Latency	715.215587ms
Throughput	68.79 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	41 occurrences

Standard Benchmark Metrics Skipped or Failed

dmihalcik-virtru

Am i right that the way this works is by downloading the whole attributes table and doing everything in memory?

service/internal/access/v2/just_in_time_pdp.go

service/internal/access/v2/errors.go

service/internal/access/v2/pdp.go

service/internal/access/v2/just_in_time_pdp.go

gemini-code-assist · 2025-05-21T14:35:13Z

Important

Installation incomplete: to start using Gemini Code Assist, please ask the organization owner(s) to visit the Gemini Code Assist Admin Console and sign the Terms of Services.

gemini-code-assist · 2025-05-21T14:35:14Z

Important

Installation incomplete: to start using Gemini Code Assist, please ask the organization owner(s) to visit the Gemini Code Assist Admin Console and sign the Terms of Services.

github-actions · 2025-05-21T14:41:05Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	472.417818ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	387.238965ms
Throughput	258.24 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m24.345391499s
Average Latency	841.309328ms
Throughput	59.28 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4975
Failed Requests	25
Concurrent Requests	50
Total Time	1m15.544384475s
Average Latency	753.078032ms
Throughput	65.86 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	25 occurrences

Standard Benchmark Metrics Skipped or Failed

gemini-code-assist · 2025-05-21T14:54:19Z

Important

Installation incomplete: to start using Gemini Code Assist, please ask the organization owner(s) to visit the Gemini Code Assist Admin Console and sign the Terms of Services.

gemini-code-assist · 2025-05-21T14:55:56Z

Important

Installation incomplete: to start using Gemini Code Assist, please ask the organization owner(s) to visit the Gemini Code Assist Admin Console and sign the Terms of Services.

gemini-code-assist · 2025-05-21T14:57:30Z

Important

Installation incomplete: to start using Gemini Code Assist, please ask the organization owner(s) to visit the Gemini Code Assist Admin Console and sign the Terms of Services.

github-actions · 2025-05-21T14:58:43Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	452.582364ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	371.884719ms
Throughput	268.90 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m19.651362697s
Average Latency	794.900607ms
Throughput	62.77 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4946
Failed Requests	54
Concurrent Requests	50
Total Time	1m10.089519722s
Average Latency	698.22608ms
Throughput	70.57 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	54 occurrences

Standard Benchmark Metrics Skipped or Failed

gemini-code-assist · 2025-05-21T16:34:35Z

Important

Installation incomplete: to start using Gemini Code Assist, please ask the organization owner(s) to visit the Gemini Code Assist Admin Console and sign the Terms of Services.

gemini-code-assist · 2025-05-21T16:34:38Z

Important

Installation incomplete: to start using Gemini Code Assist, please ask the organization owner(s) to visit the Gemini Code Assist Admin Console and sign the Terms of Services.

github-actions · 2025-05-21T16:41:20Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	456.988437ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	400.735662ms
Throughput	249.54 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m25.640143298s
Average Latency	854.003343ms
Throughput	58.38 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4945
Failed Requests	55
Concurrent Requests	50
Total Time	1m15.019875864s
Average Latency	747.029307ms
Throughput	65.92 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	55 occurrences

Standard Benchmark Metrics Skipped or Failed

gemini-code-assist · 2025-05-21T16:49:05Z

Important

Installation incomplete: to start using Gemini Code Assist, please ask the organization owner(s) to visit the Gemini Code Assist Admin Console and sign the Terms of Services.

dmihalcik-virtru

I have some performance and style worries but nothing blocking. We really should revisit the database design if it isn't meeting our performance goals, but we should formalize what those are, and hopefully get some CI around them before we make any big changes

service/internal/access/v2/pdp.go

service/internal/access/v2/evaluate.go

service/internal/access/v2/helpers.go

service/internal/access/v2/evaluate.go

github-actions · 2025-05-22T16:18:43Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	447.614951ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	354.182377ms
Throughput	282.34 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m14.397931142s
Average Latency	742.02524ms
Throughput	67.21 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4948
Failed Requests	52
Concurrent Requests	50
Total Time	1m5.034515983s
Average Latency	646.087546ms
Throughput	76.08 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	52 occurrences

Standard Benchmark Metrics Skipped or Failed

Copilot

Pull Request Overview

This PR introduces a new PDP v2 implementation for access decisions using actions, decoupling entity/policy retrieval and allowing for both in-memory and just-in-time evaluations. Key changes include a set of new validators, a redesigned Policy Decision Point with its just-in-time variant, and updated evaluation and helper logic for entitlement checks.

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
service/internal/access/v2/validators.go	Added new validations for PDP input parameters
service/internal/access/v2/pdp.go	Introduced the in-memory PDP with decision and entitlement evaluation flows
service/internal/access/v2/just_in_time_pdp.go	Implemented just-in-time PDP that fetches policy definitions and subject mappings
service/internal/access/v2/helpers.go	Provided supporting functions for attribute lookup and hierarchy processing
service/internal/access/v2/evaluate.go	Added core evaluation logic for resource decisions and entitlement rules

github-actions · 2025-05-22T17:57:21Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	458.75546ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	370.024334ms
Throughput	270.25 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m18.471350402s
Average Latency	782.782041ms
Throughput	63.72 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4946
Failed Requests	54
Concurrent Requests	50
Total Time	1m9.773491232s
Average Latency	693.512047ms
Throughput	70.89 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	54 occurrences

Standard Benchmark Metrics Skipped or Failed

service/internal/access/v2/validators_test.go

service/internal/access/v2/validators.go

github-actions · 2025-05-22T19:12:46Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	451.10047ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	562.828902ms
Throughput	177.67 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m17.629520548s
Average Latency	773.883632ms
Throughput	64.41 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4948
Failed Requests	52
Concurrent Requests	50
Total Time	1m6.804261753s
Average Latency	664.032832ms
Throughput	74.07 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	52 occurrences

Standard Benchmark Metrics Skipped or Failed

🤖 I have created a release *beep* *boop* --- ## [0.5.4](service/v0.5.3...service/v0.5.4) (2025-05-29) ### Features * **authz:** access pdp v2 with actions ([#2264](#2264)) ([7afefb7](7afefb7)) * **authz:** logic for authz v2 (actions within ABAC decisioning) ([#2146](#2146)) ([0fdc259](0fdc259)) * **policy:** Default Platform Keys ([#2254](#2254)) ([d7447fe](d7447fe)) * **policy:** Update key status's and UpdateKey rpc. ([#2315](#2315)) ([7908db9](7908db9)) ### Bug Fixes * **policy:** DSPX-1151 update of registered resource value always clears existing action attribute values ([#2325](#2325)) ([ca94425](ca94425)) * **policy:** Ensure non active keys cannot be assigned. ([#2321](#2321)) ([207d10d](207d10d)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com> Co-authored-by: Elizabeth Healy <[email protected]>

🤖 I have created a release *beep* *boop* --- ## [0.5.4](opentdf/platform@service/v0.5.3...service/v0.5.4) (2025-05-29) ### Features * **authz:** access pdp v2 with actions ([opentdf#2264](opentdf#2264)) ([7afefb7](opentdf@7afefb7)) * **authz:** logic for authz v2 (actions within ABAC decisioning) ([opentdf#2146](opentdf#2146)) ([0fdc259](opentdf@0fdc259)) * **policy:** Default Platform Keys ([opentdf#2254](opentdf#2254)) ([d7447fe](opentdf@d7447fe)) * **policy:** Update key status's and UpdateKey rpc. ([opentdf#2315](opentdf#2315)) ([7908db9](opentdf@7908db9)) ### Bug Fixes * **policy:** DSPX-1151 update of registered resource value always clears existing action attribute values ([opentdf#2325](opentdf#2325)) ([ca94425](opentdf@ca94425)) * **policy:** Ensure non active keys cannot be assigned. ([opentdf#2321](opentdf#2321)) ([207d10d](opentdf@207d10d)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com> Co-authored-by: Elizabeth Healy <[email protected]>

feat(authz): access pdp v2 with actions

677129d

jakedoublev requested a review from a team as a code owner May 20, 2025 19:53

github-actions bot added external-contributor External Org Member size/xl labels May 20, 2025

put back logging changes

9bf0e60

jakedoublev added 2 commits May 20, 2025 13:47

cleanup

5cd84cb

improvements

00ead46

cleanup

2ac9eb1

jakedoublev requested a review from Copilot May 20, 2025 22:07

Copilot AI reviewed May 20, 2025

View reviewed changes

service/internal/access/v2/helpers.go Outdated Show resolved Hide resolved

service/internal/access/v2/helpers.go Show resolved Hide resolved

service/internal/access/v2/just_in_time_pdp.go Outdated Show resolved Hide resolved

dmihalcik-virtru reviewed May 21, 2025

View reviewed changes

copilot fixes

fc74ba2

error logging suggestions

62ec151

lint fixes

31a4f3a

name errors where they are utilized

0a94bdd

jakedoublev requested review from elizabethhealy and ryanulit May 21, 2025 22:17

dmihalcik-virtru previously approved these changes May 21, 2025

View reviewed changes

service/internal/access/v2/pdp.go Outdated Show resolved Hide resolved

service/internal/access/v2/evaluate.go Outdated Show resolved Hide resolved

service/internal/access/v2/evaluate.go Outdated Show resolved Hide resolved

service/internal/access/v2/helpers.go Outdated Show resolved Hide resolved

strantalis reviewed May 22, 2025

View reviewed changes

service/internal/access/v2/evaluate.go Outdated Show resolved Hide resolved

jakedoublev added 2 commits May 22, 2025 08:23

logging suggestions

bcf4959

lower case resource attribute FQN at highest level in GetDecision flow

dd7fd44

jakedoublev dismissed stale reviews from dmihalcik-virtru and jentfoo via dd7fd44 May 22, 2025 16:14

merge duplicate actions performance

4d33515

jakedoublev requested a review from Copilot May 22, 2025 17:53

Copilot AI reviewed May 22, 2025

View reviewed changes

jakedoublev requested review from dmihalcik-virtru and strantalis May 22, 2025 18:09

jakedoublev enabled auto-merge May 22, 2025 18:12

dmihalcik-virtru previously approved these changes May 22, 2025

View reviewed changes

jakedoublev added 3 commits May 22, 2025 12:01

error assertions in tests

e1f92d8

lint fix

01007b6

improve validator logic per suggestion

8566fc4

jakedoublev dismissed dmihalcik-virtru’s stale review via 8566fc4 May 22, 2025 19:07

strantalis approved these changes May 22, 2025

View reviewed changes

jakedoublev added this pull request to the merge queue May 22, 2025

Merged via the queue into main with commit 7afefb7 May 22, 2025
28 checks passed

jakedoublev deleted the feat/access-pdp2 branch May 22, 2025 21:10

opentdf-automation bot mentioned this pull request May 22, 2025

chore(main): release service 0.5.4 #2298

Merged

feat(authz): access pdp v2 with actions #2264

feat(authz): access pdp v2 with actions #2264

Uh oh!

Conversation

jakedoublev commented May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Uh oh!

github-actions bot commented May 20, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented May 20, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented May 20, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented May 20, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

dmihalcik-virtru left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist bot commented May 21, 2025

Uh oh!

gemini-code-assist bot commented May 21, 2025

Uh oh!

github-actions bot commented May 21, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

gemini-code-assist bot commented May 21, 2025

Uh oh!

gemini-code-assist bot commented May 21, 2025

Uh oh!

gemini-code-assist bot commented May 21, 2025

Uh oh!

github-actions bot commented May 21, 2025

Benchmark Results:

Bulk Benchmark Results

jakedoublev commented May 20, 2025 •

edited

Loading