Vouch request: mohamed-gradient

[mohamed-gradient]

What do you want to work on?

I work at Gradient Technologies, and I am trying to build an OpenShell integration with our product. We currently have an authorization service that would sit behind a gateway interceptor, and I want it to approve or deny sandbox policy changes before they are committed.

While I was going through the code to figure out where to plug in our authorization server, I noticed that an interceptor that operates in the validate phase only gets the request, but not the current effective and candidate effective policies. The current_state field, which could be used to carry the current effective policy, is always set to None and doesn't seem to be used currently according to the docs. Also, there is no equivalent field for the candidate effective policy.

So I would like an interceptor operating in the validate phase to be able to see the effective policy before and after the change, and I'm happy to implement it. I already searched the existing issues and PRs and didn't find anything covering this, so I will create an issue with the implementation details.

Why this change?

We need this to allow our authorization server to see both the policy that is currently enforced and the one that will be enforced after the change, so that it can approve or deny before the change goes live.

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md