feat(policy)!: add namespace field to RegisteredResource proto by alkalescent · Pull Request #3110 · opentdf/platform

alkalescent · 2026-03-04T19:44:03Z

Summary

Adds namespace field to RegisteredResource and RegisteredResourceValue proto messages
Updates ListRegisteredResourcesRequest with namespace filter field
Generated Go protobuf code updated accordingly

This is part 1 of splitting #3106 into two PRs. Part 2 (service/lib changes) depends on this being merged first.

Test plan

Proto files compile correctly
Generated Go code matches proto definitions
No breaking changes to existing proto consumers

Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

gemini-code-assist · 2026-03-04T19:44:20Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces foundational namespace support for policy-related registered resources. It modifies core protobuf definitions to include namespace fields, allowing resources to be scoped and filtered by namespace. This change is a prerequisite for broader namespace-aware functionality, laying the groundwork for more granular policy management.

Highlights

Namespace Support for Registered Resources: Introduced a "namespace" field to the "RegisteredResource" proto message, enabling resources to be associated with specific namespaces.
Namespace Filtering for Resource Creation: Added "namespace_id" and "namespace_fqn" fields to "CreateRegisteredResourceRequest", allowing resource creation within a specified namespace with "oneof" validation.
Namespace Context for Resource Retrieval: Included an optional "namespace_fqn" field in "GetRegisteredResourceRequest" to provide namespace context for name-based lookups of registered resources.
Namespace Filtering for Resource Listing: Updated "ListRegisteredResourcesRequest" to include optional "namespace_id" and "namespace_fqn" fields, enabling filtering of registered resources by namespace.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

service/policy/objects.proto
- Added "Namespace namespace = 4;" to the "RegisteredResource" message.
service/policy/registeredresources/registered_resources.proto
- Added "namespace_id" and "namespace_fqn" fields to "CreateRegisteredResourceRequest" with "oneof" validation.
- Updated comments for the "values" field in "CreateRegisteredResourceRequest".
- Added an optional "namespace_fqn" field to "GetRegisteredResourceRequest" for name-based lookups.
- Introduced optional "namespace_id" and "namespace_fqn" fields to "ListRegisteredResourcesRequest" for filtering.

Ignored Files

Ignored by pattern: protocol/**/* (2)
- protocol/go/policy/objects.pb.go
- protocol/go/policy/registeredresources/registered_resources.pb.go

Activity

No specific review comments or activity have been recorded on this pull request yet, beyond its initial creation.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Proto fields expand, Namespace now holds the new key, Policies align.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a namespace field to the RegisteredResource protobuf message and updates related request messages to support namespacing, which is a good step towards multi-tenancy for registered resources.

I have one suggestion regarding protobuf field numbering in CreateRegisteredResourceRequest for better maintainability.

Additionally, the pull request summary mentions adding a namespace field to RegisteredResourceValue, but this change is not present in the current patch. This might be intentional and planned for a future PR, but it's worth clarifying if RegisteredResourceValue should have its own namespace field for cases where it's retrieved without its parent RegisteredResource object being fully populated.

github-actions · 2026-03-04T19:49:18Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	197.760557ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.370288ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	383.834933ms
Throughput	260.53 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.944082693s
Average Latency	427.726092ms
Throughput	116.43 requests/second

github-actions · 2026-03-04T19:56:38Z

X-Test Results

✅ go-pull-3110
✅ go-v0.9.0
✅ java-pull-3110
✅ java-v0.9.0
✅ js-pull-3110
✅ js-v0.9.0
cukes-report
bats-test-results
opentdf~~platform~~QCAYDX.dockerbuild

Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

github-actions · 2026-03-04T20:11:58Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	189.765099ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	95.343036ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	364.240046ms
Throughput	274.54 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.277088469s
Average Latency	391.321708ms
Throughput	127.30 requests/second

github-actions · 2026-03-04T20:48:51Z

X-Test Failure Report

✅ go-pull-3110
✅ go-v0.9.0
✅ java-pull-3110
✅ js-pull-3110
✅ js-v0.9.0
cukes-report
bats-test-results
opentdf~~platform~~VFVBAZ.dockerbuild

github-actions · 2026-03-04T20:52:54Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	186.828543ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	93.202558ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	382.374672ms
Throughput	261.52 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.338899353s
Average Latency	391.169425ms
Throughput	127.10 requests/second

github-actions · 2026-03-04T21:32:49Z

X-Test Results

✅ go-pull-3110
✅ go-v0.9.0
✅ java-pull-3110
✅ js-pull-3110
✅ java-v0.9.0
✅ js-v0.9.0
cukes-report
bats-test-results
opentdf~~platform~~W3CS8U.dockerbuild

🤖 I have created a release *beep* *boop* --- ## [0.17.0](protocol/go/v0.16.0...protocol/go/v0.17.0) (2026-03-05) ### ⚠ BREAKING CHANGES * **policy:** add namespace field to RegisteredResource proto ([#3110](#3110)) ### Features * **policy:** add namespace field to RegisteredResource proto ([#3110](#3110)) ([04fd85d](04fd85d)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

## Summary - Adds namespace support to Registered Resources in service layer, DB queries, and migrations - Updates identifier library for registered resource value namespace handling - Adds integration and unit tests for namespace-scoped registered resources **Depends on #3110** (proto changes) being merged first. This is part 2 of splitting #3106 into two PRs. ## Test plan - [x] Integration tests pass for registered resources with namespace - [x] Unit tests pass for identifier library changes - [x] Migration applies cleanly - [x] Existing registered resource functionality unaffected --------- Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

🤖 I have created a release *beep* *boop* --- ## [0.14.0](opentdf/platform@service/v0.13.0...service/v0.14.0) (2026-04-21) ### ⚠ BREAKING CHANGES * **sdk:** reclassify KAS 400 errors — distinguish tamper from misconfiguration ([opentdf#3166](opentdf#3166)) * **policy:** optional namespace for RRs ([opentdf#3165](opentdf#3165)) * **policy:** Namespace subject mappings and subject condition sets. ([opentdf#3143](opentdf#3143)) * **policy:** Optional namespace on actions protos, NamespacedPolicy feature flag ([opentdf#3155](opentdf#3155)) * **policy:** add namespaced actions schema and namespace-aware action queries ([opentdf#3154](opentdf#3154)) * **policy:** only require namespace on GetAction if no id provided ([opentdf#3144](opentdf#3144)) * **policy:** add namespace field to Actions proto ([opentdf#3130](opentdf#3130)) * **policy:** namespace Registered Resources ([opentdf#3111](opentdf#3111)) * **policy:** add namespace field to RegisteredResource proto ([opentdf#3110](opentdf#3110)) ### Features * **authz:** Namespaced policy in decisioning ([opentdf#3226](opentdf#3226)) ([0355934](opentdf@0355934)) * **cli:** migrate otdfctl into platform monorepo ([opentdf#3205](opentdf#3205)) ([5177bec](opentdf@5177bec)) * fix tracing ([opentdf#3242](opentdf#3242)) ([57e5680](opentdf@57e5680)) * **policy:** add GetObligationTrigger RPC ([opentdf#3318](opentdf#3318)) ([d68e39d](opentdf@d68e39d)) * **policy:** add namespace field to Actions proto ([opentdf#3130](opentdf#3130)) ([bedc9b3](opentdf@bedc9b3)) * **policy:** add namespace field to RegisteredResource proto ([opentdf#3110](opentdf#3110)) ([04fd85d](opentdf@04fd85d)) * **policy:** add namespaced actions schema and namespace-aware action queries ([opentdf#3154](opentdf#3154)) ([c0443f1](opentdf@c0443f1)) * **policy:** add sort ListSubjectMappings API ([opentdf#3255](opentdf#3255)) ([9d5d757](opentdf@9d5d757)) * **policy:** Add sort support listregisteredresources api ([opentdf#3312](opentdf#3312)) ([91a3ff3](opentdf@91a3ff3)) * **policy:** add sort support to ListAttributes API ([opentdf#3223](opentdf#3223)) ([ec3312f](opentdf@ec3312f)) * **policy:** add sort support to ListKeyAccessServer ([opentdf#3287](opentdf#3287)) ([7fae2d7](opentdf@7fae2d7)) * **policy:** Add sort support to ListNamespaces API ([opentdf#3192](opentdf#3192)) ([aac86cd](opentdf@aac86cd)) * **policy:** add sort support to listobligations api ([opentdf#3300](opentdf#3300)) ([9221cac](opentdf@9221cac)) * **policy:** add sort support to ListSubjectConditionSets API ([opentdf#3272](opentdf#3272)) ([9010f12](opentdf@9010f12)) * **policy:** add SortField proto and update PageRequest for sort support ([opentdf#3187](opentdf#3187)) ([6cf1862](opentdf@6cf1862)) * **policy:** Enforce same namespace when actions referenced downstream ([opentdf#3206](opentdf#3206)) ([4b5463a](opentdf@4b5463a)) * **policy:** namespace Registered Resources ([opentdf#3111](opentdf#3111)) ([6db1883](opentdf@6db1883)) * **policy:** Namespace subject mappings and condition sets ([opentdf#3172](opentdf#3172)) ([6deed50](opentdf@6deed50)) * **policy:** Namespace subject mappings and subject condition sets. ([opentdf#3143](opentdf#3143)) ([3006780](opentdf@3006780)) * **policy:** optional namespace for RRs ([opentdf#3165](opentdf#3165)) ([8948018](opentdf@8948018)) * **policy:** rollback migration strategy for namespaced actions ([opentdf#3235](opentdf#3235)) ([f7e5e01](opentdf@f7e5e01)) * **policy:** Seed existing namespaces with standard actions ([opentdf#3228](opentdf#3228)) ([12136b0](opentdf@12136b0)) * **policy:** Seed namespaces with standard actions on creation + namespaced actions for obligation triggers ([opentdf#3161](opentdf#3161)) ([984d76b](opentdf@984d76b)) ### Bug Fixes * **ci:** Upgrade toolchain version to 1.25.8 ([opentdf#3116](opentdf#3116)) ([e1b7882](opentdf@e1b7882)) * **core:** do not concat slashes directly in url/file paths ([opentdf#3290](opentdf#3290)) ([114c2a7](opentdf@114c2a7)) * **deps:** bump github.com/jackc/pgx/v5 from 5.7.5 to 5.9.0 in /service ([opentdf#3316](opentdf#3316)) ([017362e](opentdf@017362e)) * **deps:** bump github.com/opentdf/platform/lib/identifier from 0.2.0 to 0.3.0 in /service ([opentdf#3162](opentdf#3162)) ([8bc5dcd](opentdf@8bc5dcd)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.16.0 to 0.17.0 in /service ([opentdf#3125](opentdf#3125)) ([29fec61](opentdf@29fec61)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.17.0 to 0.21.0 in /service ([opentdf#3220](opentdf#3220)) ([e63add2](opentdf@e63add2)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.21.0 to 0.22.0 in /service ([opentdf#3248](opentdf#3248)) ([1ebce73](opentdf@1ebce73)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.22.0 to 0.23.0 in /service ([opentdf#3271](opentdf#3271)) ([3338b8e](opentdf@3338b8e)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.23.0 to 0.24.0 in /service ([opentdf#3321](opentdf#3321)) ([78e6022](opentdf@78e6022)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.24.0 to 0.25.0 in /service ([opentdf#3333](opentdf#3333)) ([3940bf8](opentdf@3940bf8)) * **deps:** bump github.com/opentdf/platform/sdk from 0.13.0 to 0.16.0 in /service ([opentdf#3356](opentdf#3356)) ([5617077](opentdf@5617077)) * **deps:** bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 in /service ([opentdf#3282](opentdf#3282)) ([046374a](opentdf@046374a)) * **deps:** bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 in /service ([opentdf#3281](opentdf#3281)) ([56b33f2](opentdf@56b33f2)) * **deps:** bump google.golang.org/grpc from 1.77.0 to 1.79.3 in /service ([opentdf#3176](opentdf#3176)) ([3289502](opentdf@3289502)) * **deps:** remove direct github.com/docker/docker dependency ([opentdf#3229](opentdf#3229)) ([2becb27](opentdf@2becb27)) * **deps:** upgrade testcontainers-go to resolve vulns ([opentdf#3299](opentdf#3299)) ([72c6f9b](opentdf@72c6f9b)) * **ers:** include standard JWT claims in claims mode entity resolution ([opentdf#3196](opentdf#3196)) ([6d50da1](opentdf@6d50da1)) * **ers:** ldap multi-strategy ers ([opentdf#3117](opentdf#3117)) ([d3aaf1a](opentdf@d3aaf1a)) * **policy:** deprecate ListAttributeValues in favor of existing GetAttribute ([opentdf#3108](opentdf#3108)) ([7e17c2d](opentdf@7e17c2d)) * **policy:** make obligation trigger uniqueness client-aware ([opentdf#3114](opentdf#3114)) ([9265bc3](opentdf@9265bc3)) * **policy:** omit empty attribute values from create responses ([opentdf#3193](opentdf#3193)) ([d298378](opentdf@d298378)) * **policy:** only require namespace on GetAction if no id provided ([opentdf#3144](opentdf#3144)) ([10d0c0f](opentdf@10d0c0f)) * **policy:** Optional namespace on actions protos, NamespacedPolicy feature flag ([opentdf#3155](opentdf#3155)) ([c20f039](opentdf@c20f039)) * **policy:** order List* results by created_at ([opentdf#3088](opentdf#3088)) ([ea90ac2](opentdf@ea90ac2)) * **sdk:** normalize issuer URL before OIDC discovery ([opentdf#3261](opentdf#3261)) ([61f98c9](opentdf@61f98c9)) * **sdk:** reclassify KAS 400 errors — distinguish tamper from misconfiguration ([opentdf#3166](opentdf#3166)) ([f04a385](opentdf@f04a385)) * **sdk:** remove testcontainers from consumer dependency graph ([opentdf#3129](opentdf#3129)) ([f17dcdd](opentdf@f17dcdd)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

feat(policy)!: add namespace field to RegisteredResource proto

880a5ed

Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

alkalescent requested review from a team as code owners March 4, 2026 19:44

github-actions Bot added the comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) label Mar 4, 2026

github-actions Bot added the size/s label Mar 4, 2026

alkalescent mentioned this pull request Mar 4, 2026

feat(policy)!: namespace Registered Resources #3111

Merged

4 tasks

gemini-code-assist Bot reviewed Mar 4, 2026

View reviewed changes

Comment thread service/policy/registeredresources/registered_resources.proto Outdated

fix: renumber namespace fields to 3/4 and reorder after name/values

44221e4

Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

restore test file from other pr

0d89d29

c-r33d approved these changes Mar 5, 2026

View reviewed changes

alkalescent added this pull request to the merge queue Mar 5, 2026

Merged via the queue into main with commit 04fd85d Mar 5, 2026
64 of 66 checks passed

alkalescent deleted the DSPX-2496-namespace-rr-proto branch March 5, 2026 21:41

This was referenced Mar 5, 2026

chore(main): release service 0.14.0 #3093

Merged

chore(main): release protocol/go 0.17.0 #3113

Merged

github-actions Bot mentioned this pull request Mar 7, 2026

fix(sdk): Updates to proto version v0.36.0 opentdf/java-sdk#345

Merged

alkalescent mentioned this pull request Jun 4, 2026

feat(policy)!: DSPX-2998 add namespace fields to resource mapping protos #3565

Merged

3 tasks

Uh oh!

Conversation

alkalescent commented Mar 4, 2026

Summary

Test plan

Uh oh!

gemini-code-assist Bot commented Mar 4, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

github-actions Bot commented Mar 4, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Mar 4, 2026

X-Test Results

Uh oh!

github-actions Bot commented Mar 4, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Mar 4, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Mar 4, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Mar 4, 2026

X-Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants