fix(authz): bound retries for missing attribute values

[strantalis]

One missing FQN turns a 250-value lookup into 251 SDK calls. Split failed batches breadth-first and retain valid subsets, while still denying resources with unknown values.

After eight failed batch probes, fall back to singleton lookups. Tests bound one missing value at 17 calls and all-missing traffic at 258 calls, and verify that other errors are returned without retries.

Layer 3 of 5, based on #3988 and rebased on main at b6163f92.

Rebase validation (2026-10-04): authorization race tests, SDK README tests, formatting, and lint for the stack diff passed. Full repository check limitations are recorded in #3991. Current CI is pending.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	231.58811ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	120.012844ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	403.358065ms
Throughput	247.92 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.438413035s
Average Latency	403.407143ms
Throughput	123.64 requests/second

[github-actions]

X-Test Results

✅ go@main-main
✅ go@main-pull-3989
✅ go@pull-3989-pull-3989
bats-test-results
✅ go@main-v0.9.0
cukes-report
✅ go@pull-3989-v0.9.0
✅ java@main-pull-3989
✅ java@main-main
✅ go@pull-3989-main
✅ js@main-main
✅ java@main-v0.9.0
✅ js@main-pull-3989
✅ js@main-v0.9.0
opentdfplatformNQABD4.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1

[github-actions]

X-Test Failure Report

govulncheck-failure-1
govulncheck-failure-8
govulncheck-failure-3

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	116.58642ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	62.330758ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	249.495848ms
Throughput	400.81 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	28.527761956s
Average Latency	284.698597ms
Throughput	175.27 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	108.597381ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	63.035776ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	236.032401ms
Throughput	423.67 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	24.967493444s
Average Latency	249.119298ms
Throughput	200.26 requests/second

[github-actions]

X-Test Results

✅ go@pull-3989-main
✅ js@main-pull-3989
✅ go@pull-3989-v0.9.0
✅ java@main-v0.9.0
✅ js@main-v0.9.0
govulncheck-failure-3
opentdfplatformZQMHIP.dockerbuild
✅ go@pull-3989-pull-3989
bats-test-results
✅ js@main-main
govulncheck-failure-8
✅ go@main-v0.9.0
✅ go@main-main
✅ java@main-pull-3989
govulncheck-failure-1
✅ java@main-main
✅ go@main-pull-3989
cukes-report

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	225.723749ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	127.896435ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	410.554163ms
Throughput	243.57 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.993333881s
Average Latency	438.713691ms
Throughput	113.65 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	237.696385ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	132.893195ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	430.01159ms
Throughput	232.55 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.754483027s
Average Latency	446.459377ms
Throughput	111.72 requests/second

[github-actions]

X-Test Results

✅ go@pull-3989-pull-3989
✅ java@main-pull-3989
✅ go@pull-3989-v0.9.0
✅ go@main-main
✅ js@main-v0.9.0
✅ js@main-main
✅ go@main-v0.9.0
opentdfplatformYMIE3G.dockerbuild
bats-test-results
govulncheck-failure-1
✅ js@main-pull-3989
✅ go@pull-3989-main
✅ java@main-main
✅ go@main-pull-3989
✅ java@main-v0.9.0
govulncheck-failure-8
govulncheck-failure-3
authorization-scale-report

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	162.799521ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	91.425373ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	341.447232ms
Throughput	292.87 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	33.178664239s
Average Latency	331.257756ms
Throughput	150.70 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	177.661952ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	82.496274ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	339.018256ms
Throughput	294.97 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	34.275095187s
Average Latency	341.956931ms
Throughput	145.88 requests/second

[github-actions]

X-Test Results

✅ go@main-main
✅ go@main-pull-3989
✅ java@main-main
✅ go@main-v0.9.0
✅ js@main-main
authorization-scale-report
✅ go@pull-3989-pull-3989
✅ go@pull-3989-v0.9.0
✅ java@main-v0.9.0
cukes-report
opentdfplatformRBZMKT.dockerbuild
✅ js@main-v0.9.0
✅ go@pull-3989-main
✅ java@main-pull-3989
govulncheck-failure-1
govulncheck-failure-3
✅ js@main-pull-3989
bats-test-results
govulncheck-failure-8

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	241.710028ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	137.663308ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	434.958577ms
Throughput	229.91 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	48.982101511s
Average Latency	488.70653ms
Throughput	102.08 requests/second

[github-actions]

X-Test Results

✅ go@main-pull-3989
✅ go@main-v0.9.0
✅ go@main-main
✅ go@pull-3989-main
✅ java@main-v0.9.0
✅ java@main-main
✅ js@main-main
cukes-report
✅ go@pull-3989-v0.9.0
bats-test-results
govulncheck-failure-3
✅ js@main-v0.9.0
✅ go@pull-3989-pull-3989
authorization-scale-report
✅ js@main-pull-3989
✅ java@main-pull-3989
opentdfplatformMRRKWG.dockerbuild
govulncheck-failure-1
govulncheck-failure-8

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	164.355795ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.654089ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	338.298124ms
Throughput	295.60 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.405232874s
Average Latency	402.785423ms
Throughput	123.75 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	166.350596ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	93.938298ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	333.897119ms
Throughput	299.49 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	32.437371548s
Average Latency	323.737038ms
Throughput	154.14 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-v0.9.0
authorization-scale-report
govulncheck-failure-8
cukes-report
✅ java@main-main
✅ go@pull-3989-main
✅ go@pull-3989-v0.9.0
✅ go@pull-3989-pull-3989
✅ go@main-pull-3989
✅ js@main-v0.9.0
govulncheck-failure-1
✅ js@main-main
✅ js@main-pull-3989
bats-test-results
✅ go@main-main
✅ java@main-pull-3989
✅ java@main-v0.9.0
opentdfplatformOHGPIK.dockerbuild
govulncheck-failure-3