feat(policy)!: Namespace subject mappings and subject condition sets. by c-r33d · Pull Request #3143 · opentdf/platform

c-r33d · 2026-03-12T13:33:41Z

Proposed Changes

1.) Optionally allow the creation of subject mappings and subject condition sets to be namespaced
2.) List subject mapping RPCs can add an optional namespace to list all subject mappings or condition sets within a requested namespace.

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

gemini-code-assist · 2026-03-12T13:34:08Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a significant architectural enhancement by integrating namespacing into key policy-related entities: SubjectMapping and SubjectConditionSet. This change mandates that these entities are created within a defined namespace, which is crucial for managing policies in multi-tenant or segmented environments. Furthermore, it extends the functionality of listing RPCs to allow filtering by namespace, providing more granular control and improving the discoverability of policy components.

Highlights

Mandatory Namespacing for Creation: The creation of SubjectMapping and SubjectConditionSet entities now requires a specified namespace, ensuring better organization and preventing naming conflicts.
Optional Namespacing for Listing RPCs: Listing RPCs for SubjectMapping and SubjectConditionSet can now optionally include a namespace, allowing users to filter and retrieve entities specific to a given namespace.
Protobuf and Validation Updates: Various protobuf definitions and their corresponding validation logic have been updated to support both namespace IDs (UUID) and Fully Qualified Names (FQN), with oneof rules enforcing that one of these identifiers must be provided where required.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

docs/grpc/index.html
- Added namespace field to policy.Action definition.
- Added namespace field to policy.RegisteredResource definition.
- Added namespace field to policy.SubjectConditionSet definition with migration notes.
- Added namespace field to policy.SubjectMapping definition with migration notes.
- Added namespace_id and namespace_fqn fields to policy.actions.CreateActionRequest.
- Added namespace_id and namespace_fqn fields to policy.actions.GetActionRequest.
- Added namespace_id and namespace_fqn fields to policy.actions.ListActionsRequest.
- Added namespace_id and namespace_fqn fields to policy.registeredresources.CreateRegisteredResourceRequest.
- Added namespace_fqn field to policy.registeredresources.GetRegisteredResourceRequest.
- Added namespace_id and namespace_fqn fields to policy.registeredresources.ListRegisteredResourcesRequest.
- Added namespace_id and namespace_fqn fields to policy.subjectmapping.CreateSubjectConditionSetRequest.
- Added namespace_id and namespace_fqn fields to policy.subjectmapping.CreateSubjectMappingRequest.
- Added namespace_id and namespace_fqn fields to policy.subjectmapping.ListSubjectConditionSetsRequest.
- Added namespace_id and namespace_fqn fields to policy.subjectmapping.ListSubjectMappingsRequest.
service/policy/actions/actions.proto
- Modified GetActionRequest to require either namespace_id or namespace_fqn.
- Modified ListActionsRequest to require either namespace_id or namespace_fqn.
- Modified CreateActionRequest to require either namespace_id or namespace_fqn.
service/policy/actions/actions_test.go
- Added new constants validNamespaceFQN and errMessageOneof.
- Updated CreateActionRequest tests to include namespace validation.
- Updated GetActionRequest tests to include namespace validation.
- Added new tests for ListActionsRequest to validate namespace fields and oneof requirements.
service/policy/objects.proto
- Added a namespace field to the Action message.
- Added a namespace field to the SubjectMapping message with migration comments.
- Added a namespace field to the SubjectConditionSet message with migration comments.
service/policy/subjectmapping/subject_condition_set_test.go
- Updated CreateSubjectConditionSetRequest tests to include NamespaceId.
- Added new tests for CreateSubjectConditionSetRequest to validate missing and invalid namespace fields.
- Added new tests for ListSubjectConditionSetsRequest to validate namespace fields and oneof requirements.
service/policy/subjectmapping/subject_mapping.proto
- Modified ListSubjectMappingsRequest to include optional namespace_id or namespace_fqn fields.
- Modified CreateSubjectMappingRequest to require either namespace_id or namespace_fqn.
- Modified ListSubjectConditionSetsRequest to include optional namespace_id or namespace_fqn fields.
- Modified CreateSubjectConditionSetRequest to require either namespace_id or namespace_fqn.
service/policy/subjectmapping/subject_mapping_test.go
- Added new constants errMessageOneof, errMessageURI, and validNamespaceFQN.
- Updated CreateSubjectMappingRequest tests to include namespace validation.
- Added new tests for CreateSubjectMappingRequest to validate missing and invalid namespace fields.
- Added new tests for ListSubjectMappingsRequest to validate namespace fields and oneof requirements.

Ignored Files

Ignored by pattern: docs/openapi/**/* (10)
- docs/openapi/authorization/authorization.openapi.yaml
- docs/openapi/authorization/v2/authorization.openapi.yaml
- docs/openapi/policy/actions/actions.openapi.yaml
- docs/openapi/policy/attributes/attributes.openapi.yaml
- docs/openapi/policy/objects.openapi.yaml
- docs/openapi/policy/obligations/obligations.openapi.yaml
- docs/openapi/policy/registeredresources/registered_resources.openapi.yaml
- docs/openapi/policy/resourcemapping/resource_mapping.openapi.yaml
- docs/openapi/policy/subjectmapping/subject_mapping.openapi.yaml
- docs/openapi/policy/unsafe/unsafe.openapi.yaml
Ignored by pattern: protocol/**/* (3)
- protocol/go/policy/actions/actions.pb.go
- protocol/go/policy/objects.pb.go
- protocol/go/policy/subjectmapping/subject_mapping.pb.go

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Proto fields now scoped, Namespaces bring order true, Code finds its right home.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces namespace support for subject mappings and condition sets, which is a significant feature. The implementation, including protocol buffer changes and corresponding tests, is comprehensive. My feedback focuses on enhancing the protobuf definitions with comments to improve the generated documentation and overall API clarity.

github-actions · 2026-03-12T13:41:23Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	206.444941ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	97.716061ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	408.418743ms
Throughput	244.85 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.535236721s
Average Latency	423.896454ms
Throughput	117.55 requests/second

github-actions · 2026-03-12T13:47:13Z

X-Test Failure Report

✅ go-v0.9.0
✅ java-v0.9.0
✅ js-v0.9.0
❌ go-pull-3143
❌ js-pull-3143
❌ java-pull-3143
cukes-report
bats-test-results
opentdf~~platform~~PXRZSX.dockerbuild

github-actions · 2026-03-12T14:27:38Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	189.015657ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.199289ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	381.840967ms
Throughput	261.89 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.587348789s
Average Latency	394.141578ms
Throughput	126.30 requests/second

github-actions · 2026-03-12T14:34:27Z

X-Test Failure Report

✅ go-v0.9.0
✅ java-v0.9.0
✅ js-v0.9.0
❌ go-pull-3143
❌ java-pull-3143
❌ js-pull-3143
bats-test-results
cukes-report
opentdf~~platform~~UEJX61.dockerbuild

github-actions · 2026-03-12T15:55:10Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	196.539677ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	93.675551ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	385.620923ms
Throughput	259.32 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.821627652s
Average Latency	406.774972ms
Throughput	122.48 requests/second

github-actions · 2026-03-12T16:02:21Z

X-Test Failure Report

✅ go-v0.9.0
✅ java-v0.9.0
✅ js-v0.9.0
❌ go-pull-3143
❌ java-pull-3143
❌ js-pull-3143
test-cases-mapping-report
bats-test-results
cukes-report
opentdf~~platform~~MC2XLZ.dockerbuild

github-actions · 2026-03-12T20:56:58Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	202.720264ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.469316ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	384.616101ms
Throughput	260.00 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.445395486s
Average Latency	412.317158ms
Throughput	120.64 requests/second

github-actions · 2026-03-12T21:02:17Z

X-Test Results

✅ go-v0.9.0
✅ go-pull-3143
✅ java-v0.9.0
✅ js-v0.9.0
✅ java-pull-3143
✅ js-pull-3143
bats-test-results
cukes-report
opentdf~~platform~~BOCUDY.dockerbuild

github-actions · 2026-03-13T14:15:26Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	206.924353ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.102243ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	379.011857ms
Throughput	263.84 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.675385463s
Average Latency	394.529993ms
Throughput	126.02 requests/second

github-actions · 2026-03-13T14:21:49Z

X-Test Failure Report

✅ go-v0.9.0
✅ java-v0.9.0
✅ js-v0.9.0
❌ go-pull-3143
❌ java-pull-3143
❌ js-pull-3143
test-cases-mapping-report
bats-test-results
cukes-report
opentdf~~platform~~QXLRLW.dockerbuild

github-actions · 2026-03-17T16:30:27Z

X-Test Failure Report

github-actions · 2026-03-17T16:36:19Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	203.376439ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	96.760989ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	397.281815ms
Throughput	251.71 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.357252966s
Average Latency	422.028474ms
Throughput	118.04 requests/second

github-actions · 2026-03-17T16:36:23Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	202.223708ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.950793ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	401.251216ms
Throughput	249.22 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.008406338s
Average Latency	428.002794ms
Throughput	116.26 requests/second

github-actions · 2026-03-17T16:42:31Z

X-Test Failure Report

test-cases-mapping-report
✅ java-v0.9.0
bats-test-results
✅ js-v0.9.0
❌ go-pull-3143
❌ java-pull-3143
❌ js-pull-3143
opentdf~~platform~~8517RX.dockerbuild

github-actions · 2026-03-17T16:46:35Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	155.494072ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	78.455032ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	391.835155ms
Throughput	255.21 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.929679502s
Average Latency	397.627278ms
Throughput	125.22 requests/second

github-actions · 2026-03-17T16:55:22Z

X-Test Results

✅ go-pull-3143
✅ go-v0.9.0
✅ java-pull-3143
✅ js-pull-3143
✅ java-v0.9.0
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
opentdf~~platform~~9PB7BH.dockerbuild

github-actions · 2026-03-17T17:54:22Z

X-Test Failure Report

github-actions · 2026-03-17T17:58:00Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	217.670168ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.830459ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	393.85153ms
Throughput	253.90 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.081871429s
Average Latency	429.180354ms
Throughput	116.06 requests/second

github-actions · 2026-03-17T17:59:40Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	203.948093ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	94.269287ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	384.141744ms
Throughput	260.32 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.535275139s
Average Latency	403.676281ms
Throughput	123.35 requests/second

github-actions · 2026-03-17T18:08:20Z

X-Test Results

✅ go-pull-3143
✅ java-pull-3143
✅ go-v0.9.0
✅ js-pull-3143
✅ java-v0.9.0
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
opentdf~~platform~~QS8GWK.dockerbuild

Co-authored-by: Krish Suchak <42231639+alkalescent@users.noreply.github.com>

github-actions · 2026-03-17T18:38:30Z

X-Test Failure Report

github-actions · 2026-03-17T18:43:19Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	189.91632ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	94.772731ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	373.567998ms
Throughput	267.69 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.367023882s
Average Latency	392.275232ms
Throughput	127.01 requests/second

github-actions · 2026-03-17T18:44:01Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	191.665271ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.804427ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	379.166329ms
Throughput	263.74 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.411227789s
Average Latency	392.433102ms
Throughput	126.87 requests/second

github-actions · 2026-03-17T18:51:17Z

X-Test Results

✅ go-v0.9.0
✅ go-pull-3143
✅ java-v0.9.0
✅ java-pull-3143
✅ js-v0.9.0
✅ js-pull-3143
cukes-report
test-cases-mapping-report
bats-test-results
opentdf~~platform~~ENKQTH.dockerbuild

🤖 I have created a release *beep* *boop* --- ## [0.20.0](protocol/go/v0.19.0...protocol/go/v0.20.0) (2026-03-18) ### ⚠ BREAKING CHANGES * **policy:** Namespace subject mappings and subject condition sets. ([#3143](#3143)) * **policy:** Optional namespace on actions protos, NamespacedPolicy feature flag ([#3155](#3155)) ### Features * **policy:** Namespace subject mappings and subject condition sets. ([#3143](#3143)) ([3006780](3006780)) ### Bug Fixes * **policy:** Optional namespace on actions protos, NamespacedPolicy feature flag ([#3155](#3155)) ([c20f039](c20f039)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [0.14.0](opentdf/platform@service/v0.13.0...service/v0.14.0) (2026-04-21) ### ⚠ BREAKING CHANGES * **sdk:** reclassify KAS 400 errors — distinguish tamper from misconfiguration ([opentdf#3166](opentdf#3166)) * **policy:** optional namespace for RRs ([opentdf#3165](opentdf#3165)) * **policy:** Namespace subject mappings and subject condition sets. ([opentdf#3143](opentdf#3143)) * **policy:** Optional namespace on actions protos, NamespacedPolicy feature flag ([opentdf#3155](opentdf#3155)) * **policy:** add namespaced actions schema and namespace-aware action queries ([opentdf#3154](opentdf#3154)) * **policy:** only require namespace on GetAction if no id provided ([opentdf#3144](opentdf#3144)) * **policy:** add namespace field to Actions proto ([opentdf#3130](opentdf#3130)) * **policy:** namespace Registered Resources ([opentdf#3111](opentdf#3111)) * **policy:** add namespace field to RegisteredResource proto ([opentdf#3110](opentdf#3110)) ### Features * **authz:** Namespaced policy in decisioning ([opentdf#3226](opentdf#3226)) ([0355934](opentdf@0355934)) * **cli:** migrate otdfctl into platform monorepo ([opentdf#3205](opentdf#3205)) ([5177bec](opentdf@5177bec)) * fix tracing ([opentdf#3242](opentdf#3242)) ([57e5680](opentdf@57e5680)) * **policy:** add GetObligationTrigger RPC ([opentdf#3318](opentdf#3318)) ([d68e39d](opentdf@d68e39d)) * **policy:** add namespace field to Actions proto ([opentdf#3130](opentdf#3130)) ([bedc9b3](opentdf@bedc9b3)) * **policy:** add namespace field to RegisteredResource proto ([opentdf#3110](opentdf#3110)) ([04fd85d](opentdf@04fd85d)) * **policy:** add namespaced actions schema and namespace-aware action queries ([opentdf#3154](opentdf#3154)) ([c0443f1](opentdf@c0443f1)) * **policy:** add sort ListSubjectMappings API ([opentdf#3255](opentdf#3255)) ([9d5d757](opentdf@9d5d757)) * **policy:** Add sort support listregisteredresources api ([opentdf#3312](opentdf#3312)) ([91a3ff3](opentdf@91a3ff3)) * **policy:** add sort support to ListAttributes API ([opentdf#3223](opentdf#3223)) ([ec3312f](opentdf@ec3312f)) * **policy:** add sort support to ListKeyAccessServer ([opentdf#3287](opentdf#3287)) ([7fae2d7](opentdf@7fae2d7)) * **policy:** Add sort support to ListNamespaces API ([opentdf#3192](opentdf#3192)) ([aac86cd](opentdf@aac86cd)) * **policy:** add sort support to listobligations api ([opentdf#3300](opentdf#3300)) ([9221cac](opentdf@9221cac)) * **policy:** add sort support to ListSubjectConditionSets API ([opentdf#3272](opentdf#3272)) ([9010f12](opentdf@9010f12)) * **policy:** add SortField proto and update PageRequest for sort support ([opentdf#3187](opentdf#3187)) ([6cf1862](opentdf@6cf1862)) * **policy:** Enforce same namespace when actions referenced downstream ([opentdf#3206](opentdf#3206)) ([4b5463a](opentdf@4b5463a)) * **policy:** namespace Registered Resources ([opentdf#3111](opentdf#3111)) ([6db1883](opentdf@6db1883)) * **policy:** Namespace subject mappings and condition sets ([opentdf#3172](opentdf#3172)) ([6deed50](opentdf@6deed50)) * **policy:** Namespace subject mappings and subject condition sets. ([opentdf#3143](opentdf#3143)) ([3006780](opentdf@3006780)) * **policy:** optional namespace for RRs ([opentdf#3165](opentdf#3165)) ([8948018](opentdf@8948018)) * **policy:** rollback migration strategy for namespaced actions ([opentdf#3235](opentdf#3235)) ([f7e5e01](opentdf@f7e5e01)) * **policy:** Seed existing namespaces with standard actions ([opentdf#3228](opentdf#3228)) ([12136b0](opentdf@12136b0)) * **policy:** Seed namespaces with standard actions on creation + namespaced actions for obligation triggers ([opentdf#3161](opentdf#3161)) ([984d76b](opentdf@984d76b)) ### Bug Fixes * **ci:** Upgrade toolchain version to 1.25.8 ([opentdf#3116](opentdf#3116)) ([e1b7882](opentdf@e1b7882)) * **core:** do not concat slashes directly in url/file paths ([opentdf#3290](opentdf#3290)) ([114c2a7](opentdf@114c2a7)) * **deps:** bump github.com/jackc/pgx/v5 from 5.7.5 to 5.9.0 in /service ([opentdf#3316](opentdf#3316)) ([017362e](opentdf@017362e)) * **deps:** bump github.com/opentdf/platform/lib/identifier from 0.2.0 to 0.3.0 in /service ([opentdf#3162](opentdf#3162)) ([8bc5dcd](opentdf@8bc5dcd)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.16.0 to 0.17.0 in /service ([opentdf#3125](opentdf#3125)) ([29fec61](opentdf@29fec61)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.17.0 to 0.21.0 in /service ([opentdf#3220](opentdf#3220)) ([e63add2](opentdf@e63add2)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.21.0 to 0.22.0 in /service ([opentdf#3248](opentdf#3248)) ([1ebce73](opentdf@1ebce73)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.22.0 to 0.23.0 in /service ([opentdf#3271](opentdf#3271)) ([3338b8e](opentdf@3338b8e)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.23.0 to 0.24.0 in /service ([opentdf#3321](opentdf#3321)) ([78e6022](opentdf@78e6022)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.24.0 to 0.25.0 in /service ([opentdf#3333](opentdf#3333)) ([3940bf8](opentdf@3940bf8)) * **deps:** bump github.com/opentdf/platform/sdk from 0.13.0 to 0.16.0 in /service ([opentdf#3356](opentdf#3356)) ([5617077](opentdf@5617077)) * **deps:** bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 in /service ([opentdf#3282](opentdf#3282)) ([046374a](opentdf@046374a)) * **deps:** bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 in /service ([opentdf#3281](opentdf#3281)) ([56b33f2](opentdf@56b33f2)) * **deps:** bump google.golang.org/grpc from 1.77.0 to 1.79.3 in /service ([opentdf#3176](opentdf#3176)) ([3289502](opentdf@3289502)) * **deps:** remove direct github.com/docker/docker dependency ([opentdf#3229](opentdf#3229)) ([2becb27](opentdf@2becb27)) * **deps:** upgrade testcontainers-go to resolve vulns ([opentdf#3299](opentdf#3299)) ([72c6f9b](opentdf@72c6f9b)) * **ers:** include standard JWT claims in claims mode entity resolution ([opentdf#3196](opentdf#3196)) ([6d50da1](opentdf@6d50da1)) * **ers:** ldap multi-strategy ers ([opentdf#3117](opentdf#3117)) ([d3aaf1a](opentdf@d3aaf1a)) * **policy:** deprecate ListAttributeValues in favor of existing GetAttribute ([opentdf#3108](opentdf#3108)) ([7e17c2d](opentdf@7e17c2d)) * **policy:** make obligation trigger uniqueness client-aware ([opentdf#3114](opentdf#3114)) ([9265bc3](opentdf@9265bc3)) * **policy:** omit empty attribute values from create responses ([opentdf#3193](opentdf#3193)) ([d298378](opentdf@d298378)) * **policy:** only require namespace on GetAction if no id provided ([opentdf#3144](opentdf#3144)) ([10d0c0f](opentdf@10d0c0f)) * **policy:** Optional namespace on actions protos, NamespacedPolicy feature flag ([opentdf#3155](opentdf#3155)) ([c20f039](opentdf@c20f039)) * **policy:** order List* results by created_at ([opentdf#3088](opentdf#3088)) ([ea90ac2](opentdf@ea90ac2)) * **sdk:** normalize issuer URL before OIDC discovery ([opentdf#3261](opentdf#3261)) ([61f98c9](opentdf@61f98c9)) * **sdk:** reclassify KAS 400 errors — distinguish tamper from misconfiguration ([opentdf#3166](opentdf#3166)) ([f04a385](opentdf@f04a385)) * **sdk:** remove testcontainers from consumer dependency graph ([opentdf#3129](opentdf#3129)) ([f17dcdd](opentdf@f17dcdd)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

c-r33d requested review from a team as code owners March 12, 2026 13:33

github-actions Bot added comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) docs Documentation size/s labels Mar 12, 2026

c-r33d changed the title ~~feat(proto)!: Namespace subject mappings and subject condition sets.~~ feat(policy)!: Namespace subject mappings and subject condition sets. Mar 12, 2026

gemini-code-assist Bot reviewed Mar 12, 2026

View reviewed changes

c-r33d force-pushed the scs-ns-protos branch from 8d78da0 to 708936d Compare March 12, 2026 15:49

elizabethhealy previously approved these changes Mar 13, 2026

View reviewed changes

c-r33d requested a review from elizabethhealy March 13, 2026 14:28

c-r33d dismissed elizabethhealy’s stale review via b919ac4 March 17, 2026 16:30

c-r33d requested a review from a team as a code owner March 17, 2026 16:30

fix.

03238df

c-r33d force-pushed the scs-ns-protos branch from 714bb51 to 03238df Compare March 17, 2026 17:52

reset tests.

4676acb

alkalescent reviewed Mar 17, 2026

View reviewed changes

Comment thread service/policy/subjectmapping/subject_mapping.proto Outdated

alkalescent previously approved these changes Mar 17, 2026

View reviewed changes

Update service/policy/subjectmapping/subject_mapping.proto

69d0e09

Co-authored-by: Krish Suchak <42231639+alkalescent@users.noreply.github.com>

c-r33d dismissed alkalescent’s stale review via 69d0e09 March 17, 2026 18:37

comments.

316c8b0

c-r33d requested a review from alkalescent March 17, 2026 18:39

elizabethhealy reviewed Mar 17, 2026

View reviewed changes

Comment thread service/policy/subjectmapping/subject_mapping.proto

elizabethhealy approved these changes Mar 17, 2026

View reviewed changes

alkalescent approved these changes Mar 17, 2026

View reviewed changes

c-r33d added this pull request to the merge queue Mar 17, 2026

Merged via the queue into main with commit 3006780 Mar 17, 2026
36 checks passed

c-r33d deleted the scs-ns-protos branch March 17, 2026 20:13

This was referenced Mar 17, 2026

chore(main): release protocol/go 0.20.0 #3163

Merged

chore(main): release service 0.14.0 #3093

Merged

This was referenced Mar 20, 2026

fix(sdk): Updates to proto version v0.36.0 opentdf/java-sdk#345

Merged

fix(sdk): Updates to proto version protocol/go/v0.37.0 opentdf/web-sdk#866

Closed

Uh oh!

Conversation

c-r33d commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Uh oh!

gemini-code-assist Bot commented Mar 12, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Mar 12, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Mar 12, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Mar 12, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Mar 12, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Mar 12, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Mar 12, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Mar 12, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Mar 12, 2026

X-Test Results

Uh oh!

github-actions Bot commented Mar 13, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Mar 13, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Mar 17, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Mar 17, 2026

c-r33d commented Mar 12, 2026 •

edited

Loading