fix(authz): keep shared policy values immutable

[strantalis]

Proposed Changes

Constructing a PDP appended subject mappings directly to policy values supplied by the caller. Reusing those values accumulated mappings across constructions and allowed concurrent constructors to mutate shared state.

Clone values before attaching mappings, including values introduced by a subject mapping. This makes shared policy snapshots safe for the next layer.

Layer 2 of 7 in the authorization performance stack. Review and merge from the bottom upward.

Checklist

• Added or updated unit or integration coverage appropriate to this layer
• Ran focused verification for this layer
• Documented behavior and validation limits below

Testing Instructions

• Added a regression test constructing 16 PDPs concurrently from the same policy objects. Every PDP has exactly one copy of each mapping, and the original protobufs remain unchanged.
• Authorization v2 and access v2 race tests passed.

Stack-wide validation:

• Focused race tests, the full verbose policy integration suite with the race detector, SDK README code-block tests, formatting, and service lint restricted to changes since the stack base passed with zero new issues.
• make test was attempted with Colima configured. The round-trip suite failed because its required platform server at 127.0.0.1:8080 was not running.
• make lint stopped because the configured Buf API token is invalid. Separate make go-lint reported existing repository issues; the formatting issue in the new hierarchy test was corrected.
• make govulncheck reported vulnerabilities in the existing dependencies and the installed Go 1.26.3 standard library. This stack changes no dependency versions.
• GitHub CI is still running. Keep this stack in draft pending review and CI results.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	169.965114ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	91.810697ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	331.67094ms
Throughput	301.50 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	31.4865355s
Average Latency	314.101303ms
Throughput	158.80 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-pull-3987
✅ go@pull-3987-pull-3987
bats-test-results
✅ go@main-main
✅ go@main-v0.9.0
✅ go@pull-3987-v0.9.0
✅ java@main-main
cukes-report
✅ go@pull-3987-main
✅ js@main-main
✅ java@main-v0.9.0
✅ java@main-pull-3987
✅ js@main-v0.9.0
✅ js@main-pull-3987
opentdfplatformWM8ROK.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1