feat(authz): add casbin roleprovider interface by elizabethhealy · Pull Request #3069 · opentdf/platform

elizabethhealy · 2026-02-11T05:32:21Z

Summary of Changes

This pull request introduces a flexible and extensible role provider mechanism for Casbin. It decouples the logic for extracting user roles from the core authorization engine, allowing for custom implementations beyond just JWT claims. This change improves the modularity and adaptability of the authorization framework, making it easier to integrate diverse role identification methods and configure them programmatically or declaratively.

Highlights

New Role Provider Interface: Introduced a new authz.RoleProvider interface and RoleRequest struct to abstract how user roles are extracted for Casbin authorization, allowing for custom implementations.
Configurable Role Extraction: The Casbin enforcer now uses a configurable RoleProvider to determine user roles, moving away from hardcoded JWT claim parsing. A default jwtClaimsRoleProvider is provided for existing functionality.
Programmatic Configuration: Added options (WithAuthZRoleProvider, WithAuthZRoleProviderFactory) to programmatically set or register custom role providers during server startup.
Updated Casbin Enforcement: Modified the Enforce method in the Casbin enforcer to accept a context and RoleRequest, providing more context to role providers during authorization checks.

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

gemini-code-assist · 2026-02-11T05:32:43Z

Summary of Changes

Hello @elizabethhealy, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the authorization system by introducing a flexible and extensible role provider mechanism for Casbin. It decouples role extraction logic from the core authorization engine, enabling developers to integrate custom methods for identifying user roles based on various sources, not just JWT claims. This change improves the modularity and adaptability of the authorization framework.

Highlights

New Role Provider Interface: Introduced a new authz.RoleProvider interface and RoleRequest struct to abstract how user roles are extracted for Casbin authorization, allowing for custom implementations.
Configurable Role Extraction: The Casbin enforcer now uses a configurable RoleProvider to determine user roles, moving away from hardcoded JWT claim parsing. A default jwtClaimsRoleProvider is provided for existing functionality.
Programmatic Configuration: Added options (WithAuthZRoleProvider, WithAuthZRoleProviderFactory) to programmatically set or register custom role providers during server startup.
Updated Casbin Enforcement: Modified the Enforce method in the Casbin enforcer to accept a context and RoleRequest, providing more context to role providers during authorization checks.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

service/internal/auth/authn.go
- Imported the new authz package.
- Modified NewAuthenticator to resolve and integrate a RoleProvider into the Casbin configuration.
- Updated Enforce calls within MuxHandler and ConnectUnaryServerInterceptor to pass context and the new RoleRequest.
service/internal/auth/casbin.go
- Imported context and authz packages.
- Added roleProvider field to the Enforcer and CasbinConfig structs.
- Updated NewCasbinEnforcer to initialize the roleProvider.
- Modified the Enforce method signature to accept context and authz.RoleRequest, and utilized the roleProvider for role extraction.
- Updated buildSubjectFromToken to use the roleProvider and return an error.
- Removed the extractRolesFromToken method, as its functionality is now handled by the RoleProvider interface.
service/internal/auth/casbin_test.go
- Imported context and authz packages.
- Added a new helper function enforce to simplify calls to the updated Enforcer.Enforce method.
- Updated existing test cases to use the new enforce helper function.
- Added a new test Test_ExternalRoleProvider to verify the integration of external role providers.
service/internal/auth/config.go
- Imported the authz package.
- Added RoleProvider and RoleProviderFactories fields to the Config struct for programmatic overrides.
- Added a RolesProvider string field to PolicyConfig to specify a named role provider.
service/internal/auth/role_provider.go
- Added a new file.
- Defined jwtClaimsRoleProvider to encapsulate the default JWT claim-based role extraction logic.
- Implemented newJWTClaimsRoleProvider to create instances of the default provider.
- Implemented resolveRoleProvider to select the appropriate role provider based on configuration or programmatic overrides.
service/internal/auth/role_provider_test.go
- Added a new file.
- Included tests for the resolveRoleProvider function, covering default, named, and missing provider scenarios.
service/pkg/authz/role_provider.go
- Added a new file.
- Defined the RoleProvider interface for abstracting role extraction.
- Defined RoleProviderFactory for creating role providers.
- Defined the RoleRequest struct to pass context to role providers.
service/pkg/server/options.go
- Imported the authz package.
- Added authzRoleProvider and authzRoleProviderFactories fields to StartConfig.
- Introduced WithAuthZRoleProvider and WithAuthZRoleProviderFactory options for configuring role providers programmatically.
service/pkg/server/options_test.go
- Imported authz and jwt packages.
- Added noopRoleProvider for testing purposes.
- Included tests for WithAuthZRoleProvider and WithAuthZRoleProviderFactory options.
service/pkg/server/start.go
- Updated the Start function to apply authzRoleProvider and authzRoleProviderFactories from StartConfig to the main server configuration.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

A token flies, a claim is read, Roles are found, by logic led. Access granted, or denied with grace, Casbin's rules, in their proper place.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

github-actions · 2026-02-11T05:36:50Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	210.740728ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.594515ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	364.825039ms
Throughput	274.10 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.708987025s
Average Latency	385.314425ms
Throughput	129.17 requests/second

gemini-code-assist

Code Review

This pull request introduces a RoleProvider interface to make role extraction for Casbin authorization pluggable. The changes are well-structured, introducing the new interface, a default implementation that maintains existing behavior, and configuration options to use it. I've found a few areas for improvement regarding Go idioms and error handling to increase code robustness and maintainability. My comments provide specific suggestions for these improvements.

github-actions · 2026-02-11T05:39:36Z

X-Test Failure Report

opentdf~~platform~~65SDCH.dockerbuild
cukes-report

github-actions · 2026-02-11T05:43:25Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	193.452642ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.280216ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	360.011679ms
Throughput	277.77 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.798808961s
Average Latency	386.272417ms
Throughput	128.87 requests/second

github-actions · 2026-02-11T05:47:46Z

X-Test Failure Report

opentdf~~platform~~J279PW.dockerbuild
cukes-report
✅ js-pull-3069
✅ js-v0.9.0

github-actions · 2026-02-11T05:51:25Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	190.950678ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	97.098763ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	365.791112ms
Throughput	273.38 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.428881113s
Average Latency	382.045069ms
Throughput	130.11 requests/second

github-actions · 2026-02-11T05:58:48Z

X-Test Results

opentdf~~platform~~L9OCWM.dockerbuild
cukes-report
✅ js-pull-3069
✅ js-v0.9.0
✅ java-v0.9.0
✅ java-pull-3069
bats-test-results
test-cases-mapping-report
✅ go-v0.9.0
✅ go-pull-3069

github-actions · 2026-02-11T17:06:16Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	198.736682ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.959879ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	373.69476ms
Throughput	267.60 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.722105282s
Average Latency	415.420259ms
Throughput	119.84 requests/second

github-actions · 2026-02-11T17:12:58Z

X-Test Results

opentdf~~platform~~0635CJ.dockerbuild
cukes-report
✅ js-v0.9.0
✅ js-pull-3069
✅ java-v0.9.0
✅ java-pull-3069
bats-test-results
✅ go-pull-3069
test-cases-mapping-report
✅ go-v0.9.0

elizabethhealy · 2026-02-11T19:44:27Z

/gemini summary

elizabethhealy · 2026-02-11T19:44:32Z

/gemini review

gemini-code-assist · 2026-02-11T19:44:56Z

Summary of Changes

This pull request significantly enhances the authorization system by introducing a flexible and extensible role provider mechanism for Casbin. It decouples the logic for extracting user roles from the core authorization engine, allowing for custom implementations beyond just JWT claims. This change improves the modularity and adaptability of the authorization framework, making it easier to integrate diverse role identification methods and configure them programmatically or declaratively.

Highlights

New Role Provider Interface: Introduced a new authz.RoleProvider interface and RoleRequest struct to abstract how user roles are extracted for Casbin authorization, allowing for custom implementations.
Configurable Role Extraction: The Casbin enforcer now uses a configurable RoleProvider to determine user roles, moving away from hardcoded JWT claim parsing. A default jwtClaimsRoleProvider is provided for existing functionality.
Programmatic Configuration: Added options (WithAuthZRoleProvider, WithAuthZRoleProviderFactory) to programmatically set or register custom role providers during server startup.
Updated Casbin Enforcement: Modified the Enforce method in the Casbin enforcer to accept a context and RoleRequest, providing more context to role providers during authorization checks.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

opentdf-dev.yaml
- Added commented-out configuration for an optional external role provider.
service/internal/auth/authn.go
- Imported the authz package.
- Integrated RoleProvider resolution into NewAuthenticator.
- Updated MuxHandler and ConnectUnaryServerInterceptor to pass context and authz.RoleRequest to the Casbin enforcer.
- Changed error checking to use errors.Is with ErrPermissionDenied.
service/internal/auth/casbin.go
- Imported context and authz packages.
- Introduced ErrPermissionDenied as a sentinel error.
- Added a roleProvider field to the Enforcer and CasbinConfig structs.
- Modified NewCasbinEnforcer to initialize the roleProvider, defaulting to a JWT claims provider if none is specified.
- Updated the Enforce method signature to accept context and authz.RoleRequest.
- Refactored buildSubjectFromToken to utilize the new roleProvider and return an error.
- Removed the extractRolesFromToken method.
service/internal/auth/casbin_test.go
- Imported context and authz packages.
- Updated all calls to enforcer.Enforce to use a new helper function s.enforce for passing context and authz.RoleRequest.
- Added a new test case Test_ExternalRoleProvider to verify custom role provider integration.
service/internal/auth/config.go
- Imported the authz package.
- Added RoleProvider and RoleProviderFactories fields to the Config struct for programmatic overrides.
- Introduced RolesProviderConfig struct and added a RolesProvider field to PolicyConfig for declarative role provider configuration.
service/internal/auth/role_provider.go
- Added a new file defining jwtClaimsRoleProvider for default JWT claim-based role extraction.
- Implemented newJWTClaimsRoleProvider to create instances of the default provider.
- Implemented resolveRoleProvider to select the appropriate role provider based on configuration or programmatic overrides.
service/internal/auth/role_provider_test.go
- Added a new file containing unit tests for the resolveRoleProvider function, covering default, named, and missing provider scenarios.
service/pkg/authz/role_provider.go
- Added a new file defining the RoleProvider interface, RoleProviderFactory type, ProviderConfig struct, and RoleRequest struct to abstract and provide context for role extraction.
service/pkg/server/options.go
- Imported the authz package.
- Added authzRoleProvider and authzRoleProviderFactories fields to StartConfig.
- Introduced WithAuthZRoleProvider and WithAuthZRoleProviderFactory options for programmatic configuration of role providers.
service/pkg/server/options_test.go
- Imported authz and jwt packages.
- Added a noopRoleProvider for testing purposes.
- Included new tests for WithAuthZRoleProvider and WithAuthZRoleProviderFactory options.
service/pkg/server/start.go
- Modified the Start function to apply programmatically configured authzRoleProvider and authzRoleProviderFactories to the server's authentication configuration.

Activity

An initial summary and highlights were provided by gemini-code-assist[bot].
Multiple benchmark results and X-Test reports were posted by github-actions[bot], some indicating failures and others successes.
gemini-code-assist[bot] suggested using short variable declarations (:=) in service/internal/auth/authn.go for clientID, err, which was not incorporated into the final patch.
gemini-code-assist[bot] suggested using a sentinel error for "permission denied" in service/internal/auth/casbin.go and service/internal/auth/authn.go, which was incorporated into the patch by introducing ErrPermissionDenied.
gemini-code-assist[bot] questioned the complexity of a warning condition in service/internal/auth/role_provider.go. elizabethhealy responded, explaining the intentional gating of the warning to specific scenarios where both direct provider and factory options are set alongside a configured roles_provider.
elizabethhealy explicitly requested /gemini summary and /gemini review.

gemini-code-assist

Code Review

This pull request introduces a flexible and extensible role provider mechanism for Casbin, which is a great enhancement for modularity and adaptability. The code is well-structured, with the new authz.RoleProvider interface and related components clearly defined in the new service/pkg/authz/role_provider.go file. The refactoring to move JWT claim extraction logic into its own jwtClaimsRoleProvider is a clean separation of concerns. The changes are also accompanied by relevant tests. I have a couple of suggestions to improve warning and error messages for configuration issues, which should enhance the developer experience when using this new feature.

github-actions · 2026-02-11T19:49:12Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	192.839055ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	97.166308ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	370.086285ms
Throughput	270.21 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.335852131s
Average Latency	391.225784ms
Throughput	127.11 requests/second

github-actions · 2026-02-11T19:52:11Z

X-Test Failure Report

opentdf~~platform~~KUZPFI.dockerbuild
cukes-report
✅ js-pull-3069

github-actions · 2026-02-11T19:56:15Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	191.078934ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	96.94411ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	368.80819ms
Throughput	271.14 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.834647865s
Average Latency	386.150359ms
Throughput	128.75 requests/second

github-actions · 2026-02-11T20:02:57Z

X-Test Results

opentdf~~platform~~OX7J82.dockerbuild
cukes-report
✅ js-pull-3069
✅ js-v0.9.0
✅ java-pull-3069
✅ java-v0.9.0
bats-test-results
test-cases-mapping-report
✅ go-pull-3069
✅ go-v0.9.0

github-actions · 2026-02-12T20:44:01Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	192.574267ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	102.35862ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	372.935317ms
Throughput	268.14 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.340231443s
Average Latency	391.982445ms
Throughput	127.10 requests/second

github-actions · 2026-02-12T20:51:13Z

X-Test Results

opentdf~~platform~~HXWH5B.dockerbuild
cukes-report
✅ js-pull-3069
✅ js-v0.9.0
✅ java-v0.9.0
✅ java-pull-3069
bats-test-results
✅ go-pull-3069
test-cases-mapping-report
✅ go-v0.9.0

🤖 I have created a release *beep* *boop* --- ## [0.13.0](service/v0.12.0...service/v0.13.0) (2026-02-18) ### ⚠ BREAKING CHANGES * **policy:** remove namespace certificate feature ([#3051](#3051)) ### Features * **authz:** add casbin roleprovider interface ([#3069](#3069)) ([9d6b3f3](9d6b3f3)) * **core:** add interceptors to start options ([#3031](#3031)) ([e0b4e93](e0b4e93)) ### Bug Fixes * **deps:** bump github.com/opentdf/platform/lib/fixtures from 0.4.0 to 0.5.0 in /service ([#3034](#3034)) ([66b61b1](66b61b1)) * **deps:** bump github.com/opentdf/platform/lib/ocrypto from 0.9.0 to 0.10.0 in /service ([#3080](#3080)) ([49582f0](49582f0)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.15.0 to 0.16.0 in /service ([#3083](#3083)) ([a332f95](a332f95)) * **deps:** vulnerability fix in connect-rpc validate and ristretto ([#3065](#3065)) ([8860fed](8860fed)) * Go 1.25 ([#3053](#3053)) ([65eb7c3](65eb7c3)) * **kas:** dont hardcode P-256 curve ([#3073](#3073)) ([826d857](826d857)) * **kas:** Fix EC P-521 typo ([#3075](#3075)) ([abc088d](abc088d)) * **policy:** reject unencrypted private keys for modes 1/2 ([#3072](#3072)) ([e2dc6d8](e2dc6d8)) ### Code Refactoring * **policy:** remove namespace certificate feature ([#3051](#3051)) ([48abb81](48abb81)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

elizabethhealy added 2 commits February 11, 2026 00:28

add role provider

6e6b22b

add start options tests

89dcf6f

github-actions Bot added comp:middleware:auth size/m labels Feb 11, 2026

gemini-code-assist Bot reviewed Feb 11, 2026

View reviewed changes

Comment thread service/internal/auth/authn.go Outdated

Comment thread service/internal/auth/authn.go Outdated

Comment thread service/internal/auth/casbin.go Outdated

Comment thread service/internal/auth/role_provider.go

linting

ce33a27

linting and gemini comments

b7da9c2

fix test

4442f8e

add more configurability, give as much info as possible

1680f3e

gemini-code-assist Bot reviewed Feb 11, 2026

View reviewed changes

Comment thread service/internal/auth/role_provider.go

Comment thread service/internal/auth/role_provider.go

address comment

68313e1

elizabethhealy marked this pull request as ready for review February 11, 2026 20:23

elizabethhealy requested a review from a team as a code owner February 11, 2026 20:23

jakedoublev requested a review from alkalescent February 11, 2026 21:01

alkalescent reviewed Feb 11, 2026

View reviewed changes

Comment thread service/internal/auth/casbin_test.go Outdated

alkalescent reviewed Feb 11, 2026

View reviewed changes

Comment thread service/internal/auth/casbin.go Outdated

alkalescent reviewed Feb 11, 2026

View reviewed changes

Comment thread service/internal/auth/role_provider_test.go Outdated

take suggestions

b1b7c3d

elizabethhealy requested a review from alkalescent February 12, 2026 20:56

alkalescent approved these changes Feb 13, 2026

View reviewed changes

elizabethhealy added this pull request to the merge queue Feb 13, 2026

Merged via the queue into main with commit 9d6b3f3 Feb 13, 2026
39 checks passed

elizabethhealy deleted the dspx-2398-casbin-role-provider branch February 13, 2026 19:28

opentdf-automation Bot mentioned this pull request Feb 13, 2026

chore(main): release service 0.13.0 #3058

Merged

Uh oh!

Conversation

elizabethhealy commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of Changes

Highlights

Checklist

Testing Instructions

Uh oh!

gemini-code-assist Bot commented Feb 11, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

github-actions Bot commented Feb 11, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Feb 11, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Feb 11, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Feb 11, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Feb 11, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Feb 11, 2026

X-Test Results

Uh oh!

github-actions Bot commented Feb 11, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Feb 11, 2026

X-Test Results

Uh oh!

elizabethhealy commented Feb 11, 2026

Uh oh!

elizabethhealy commented Feb 11, 2026

Uh oh!

gemini-code-assist Bot commented Feb 11, 2026

Summary of Changes

Highlights

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Feb 11, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

elizabethhealy commented Feb 11, 2026 •

edited

Loading