[ https://issues.jboss.org/browse/TEIID-5798?page=com.atlassian.jira.plugin... ] Steven Hawkins updated TEIID-5798: ---------------------------------- Original Estimate: 6 hours Remaining Estimate: 6 hours Story Points: 3 Estimated Difficulty: Medium Affects: Documentation (Ref Guide, User Guide, etc.),Release Notes The current logic treats conditions as applicable to the policy regardless of how the permissions are defined. This largely comports with the old designer happy path - there was one permission/grant per object. As Christoph shows in the example it make sense that multiple ddl statements can be used, so that the meaning of the condition can be contextual to those operations. For this to work the we have two choices. 1. To support multiple grant statements we have to undo the logic that effectively combines permissions - internally we have the same assumption that everything about securing an object can be expressed in a single permission object - and change the security logic to also consider the operation when getting the conditions to apply. Note that this would make things like masks also only have meaning when used on a grant that includes select. 2. Expand the definition of a grant statement to optionally specify what operations the condition is applicable to. This will have a similar amount of work to 1, but limits things to a single conditional that is conditionally applied. -- This message was sent by Atlassian Jira (v7.13.8#713008)