Add semantic model privileges

[flyrain]

Add SEMANTIC_MODEL_* privileges from the semantic-layer proposal for list, create, read, update, drop, and full metadata access, with catalog/namespace inheritance. The existing catalog-role grants API supports granting and revoking privileges on individual semantic models and returns those grants in the role's grant list. Related to #4522.

Checklist

• 🛡️ Don't disclose security issues! (contact security@apache.org)
• 🔗 Clearly explained why the changes are needed, or linked related issues: Related to Add OSI (Open Semantic Interchange) Support in Polaris #4522
• 🧪 Added/updated tests with good coverage, or manually tested (and explained how)
• 💡 Added comments for complex logic
• 🧾 Updated CHANGELOG.md (if needed)
• 📚 Updated documentation in site/content/in-dev/unreleased (if needed)

[Copilot]

🟡 Changes recommended

Complete the API authorization documentation and add inherited-scope coverage for create, list, and drop privileges.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds dedicated semantic-model RBAC privileges with namespace/catalog inheritance, authorization mappings, tests, API documentation, and changelog updates.

Changes:

• Adds six semantic-model privileges and management API values.
• Implements operation mappings, inheritance, and umbrella privilege handling.
• Adds authorization tests and updates documentation.

File summaries

File	Summary
spec/polaris-management-service.yml	Exposes semantic-model privileges in management APIs.
spec/polaris-catalog-apis/semantic-models-api.yaml	Documents semantic-model endpoint authorization requirements.
site/content/in-dev/unreleased/managing-security/access-control.md	Documents privilege scopes and inheritance.
runtime/service/src/test/java/org/apache/polaris/service/admin/SemanticModelGrantAuthzTest.java	Tests management API grant round trips.
polaris-core/src/test/java/org/apache/polaris/core/entity/PolarisPrivilegeTest.java	Tests privilege code mappings.
polaris-core/src/main/java/org/apache/polaris/core/entity/PolarisPrivilege.java	Defines semantic-model privilege constants.
polaris-core/src/main/java/org/apache/polaris/core/auth/RbacOperationSemantics.java	Maps operations to semantic-model privileges.
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java	Implements inheritance and umbrella privilege authorization.
extensions/semantic-models/src/test/java/org/apache/polaris/service/catalog/semanticmodel/SemanticModelCatalogHandlerAuthzTest.java	Tests semantic-model authorization behavior; dedicated inherited-scope cases remain incomplete.
extensions/semantic-models/src/main/java/org/apache/polaris/service/catalog/semanticmodel/SemanticModelCatalogHandler.java	Updates semantic-model handler authorization documentation.
CHANGELOG.md	Records the new feature.

Review details

Suppressed comments (3)

extensions/semantic-models/src/test/java/org/apache/polaris/service/catalog/semanticmodel/SemanticModelCatalogHandlerAuthzTest.java:244

• The added authorization tests cover catalog/namespace inheritance for the umbrella privileges and for READ/WRITE, but they do not exercise the newly supported catalog/namespace grants for SEMANTIC_MODEL_CREATE, SEMANTIC_MODEL_LIST, or SEMANTIC_MODEL_DROP. A regression in those dedicated privilege mappings could therefore pass while the PR's catalog/namespace inheritance contract is broken; please add those scope/operation cases to the matrix.

  static Stream<Arguments> umbrellaPrivileges() {
    return Stream.of(
        Arguments.of(PolarisPrivilege.SEMANTIC_MODEL_FULL_METADATA, false),
        Arguments.of(PolarisPrivilege.SEMANTIC_MODEL_FULL_METADATA, true),
        Arguments.of(PolarisPrivilege.NAMESPACE_FULL_METADATA, false),
        Arguments.of(PolarisPrivilege.CATALOG_FULL_METADATA, true),
        Arguments.of(PolarisPrivilege.CATALOG_MANAGE_METADATA, true),
        Arguments.of(PolarisPrivilege.CATALOG_MANAGE_CONTENT, true));

spec/polaris-catalog-apis/semantic-models-api.yaml:170

• This requirement is narrower than the behavior implemented here: authorization walks the model's resolved path, so a SEMANTIC_MODEL_WRITE grant on the namespace (or catalog) also authorizes the update, as documented in access-control.md. Please mention the applicable inherited namespace/catalog grant so API consumers are not told that only a model-scoped grant works.

        Replace a semantic model's document with a new one. Requires
        SEMANTIC_MODEL_WRITE on the model.

spec/polaris-catalog-apis/semantic-models-api.yaml:38

• The create endpoint has the same inherited-scope omission: catalog- and ancestor-namespace grants are accepted by the new authorization hierarchy, but this text says the privilege must be directly on the target namespace. Please document the inherited namespace/catalog scope here as well.

        Creates a semantic model in the specified namespace. Requires SEMANTIC_MODEL_CREATE
        on the namespace.

• Files reviewed: 11/11 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[dimas-b]

By convention, REST API changes generally need a dev discussion thread for awareness... Could you start one?

[flyrain]

Sent to the dev mailing list: https://lists.apache.org/thread/50q3g2p3g2f63mkkkxt8d460fxct1229