fix(authz): reuse compiled policy snapshots

[strantalis]

Proposed Changes

Authorization rebuilt registered-resource and obligation indexes for each request, and built the registered-resource index again for its inner PDP. Introduce an immutable prepared policy object and reuse its indexes.

With the optional policy cache enabled, publish raw policy and prepared indexes as one atomic snapshot. Coalesce successful cold-start loads, retain the previous complete snapshot if refresh fails, and retrieve full attributes and subject mappings only when direct entitlements or dynamic mappings require them. Cache-disabled requests still fetch current policy and compile once per JIT PDP.

Caching remains disabled by default. When enabled, policy visibility follows successful refreshes; failed refreshes retain the last successful snapshot. This replaces the generic service cache with one process-local snapshot and requires no configuration migration.

Layer 3 of 7 in the authorization performance stack. Review and merge from the bottom upward.

Checklist

• Added or updated unit or integration coverage appropriate to this layer
• Ran focused verification for this layer
• Documented behavior and validation limits below

Testing Instructions

• Race tests cover 32 concurrent cold readers sharing one load, snapshot replacement, retention after refresh failure, disabled/unavailable cache, and experimental feature gates.
• Access v2 and authorization v2 race tests passed.
• Updated cache behavior documentation in docs/Configuring.md.

Stack-wide validation:

• Focused race tests, the full verbose policy integration suite with the race detector, SDK README code-block tests, formatting, and service lint restricted to changes since the stack base passed with zero new issues.
• make test was attempted with Colima configured. The round-trip suite failed because its required platform server at 127.0.0.1:8080 was not running.
• make lint stopped because the configured Buf API token is invalid. Separate make go-lint reported existing repository issues; the formatting issue in the new hierarchy test was corrected.
• make govulncheck reported vulnerabilities in the existing dependencies and the installed Go 1.26.3 standard library. This stack changes no dependency versions.
• GitHub CI is still running. Keep this stack in draft pending review and CI results.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	175.497811ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.944084ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	346.911259ms
Throughput	288.26 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.684180442s
Average Latency	376.059675ms
Throughput	132.68 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@pull-3988-pull-3988
✅ go@main-pull-3988
✅ go@main-main
✅ go@pull-3988-main
✅ go@main-v0.9.0
✅ go@pull-3988-v0.9.0
bats-test-results
cukes-report
✅ js@main-pull-3988
✅ js@main-main
✅ java@main-pull-3988
✅ java@main-v0.9.0
✅ java@main-main
✅ js@main-v0.9.0
opentdfplatformG3KMIE.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1