Skip to content

docs(policy): deprecate non-namespaced registered resources#253

Open
alkalescent wants to merge 7 commits intomainfrom
DSPX-2496-rr-ns
Open

docs(policy): deprecate non-namespaced registered resources#253
alkalescent wants to merge 7 commits intomainfrom
DSPX-2496-rr-ns

Conversation

@alkalescent
Copy link
Copy Markdown
Contributor

@alkalescent alkalescent commented Mar 18, 2026

This PR documents the deprecation of non-namespaced registered resources and how to migrate existing resources using otdfctl.

Summary by CodeRabbit

  • New Features

    • Added optional Namespace support for Registered Resources with new scoped FQN format.
    • Added sort direction API schema options.
  • Documentation

    • Clarified policy component descriptions with concrete examples.
    • Added migration guide for existing Registered Resources.
    • Marked non-namespaced Registered Resources as deprecated.

@gemini-code-assist
Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request primarily focuses on updating the documentation to reflect the deprecation of non-namespaced registered resources within the policy system. It introduces the concept of namespaced registered resources, provides clear examples of their Fully Qualified Names (FQNs), and outlines the necessary migration steps for existing resources. These changes ensure that the documentation aligns with the evolving policy architecture, guiding users towards the recommended, namespaced approach for managing registered resources.

Highlights

  • Deprecation of Non-Namespaced Registered Resources: Non-namespaced Registered Resources are now officially deprecated, with a future version requiring all Registered Resources to be associated with a namespace.
  • Migration Path Documented: Documentation now includes instructions on how to migrate existing non-namespaced Registered Resources using the otdfctl migrate registered-resources command.
  • FQN Examples Updated: Fully Qualified Name (FQN) examples for Registered Resources have been updated across the documentation to reflect the new namespaced structure and explicitly mark the deprecated non-namespaced format.
  • Namespace Scope Expansion: Namespaces are now explicitly documented as organizational containers for both attributes and optionally for registered resources, clarifying their expanded role.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request effectively documents the deprecation of non-namespaced registered resources. The changes are consistent across all modified files, updating definitions, examples, and diagrams to reflect that registered resources are now namespaced. The documentation is clearer and more accurate as a result. I have one suggestion to further improve the migration instructions to make them more actionable for users.

@github-actions
Copy link
Copy Markdown
Contributor

📄 Preview deployed to https://opentdf-docs-pr-253.surge.sh

@alkalescent alkalescent marked this pull request as ready for review April 1, 2026 14:01
@alkalescent alkalescent requested review from a team as code owners April 1, 2026 14:01
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Apr 1, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f904cf92-b22e-44a1-a63d-8dbb0c888cbe

📥 Commits

Reviewing files that changed from the base of the PR and between 28abb3a and 1f0418c.

📒 Files selected for processing (1)
  • specs/policy/selectors.openapi.yaml
✅ Files skipped from review due to trivial changes (1)
  • specs/policy/selectors.openapi.yaml

📝 Walkthrough

Walkthrough

Introduces namespacing for Registered Resources across docs and vocabularies, updates FQN formats and deprecation notices for non‑namespaced resources, documents an otdfctl migrate registered-resources workflow, tweaks acceptance patterns for plural forms, and adds a new OpenAPI enum policy.SortDirection.

Changes

Cohort / File(s) Summary
Vale Configuration
.github/vale-styles/config/vocabularies/Opentdf/accept.txt
Broadened vocabulary patterns to accept namespace variants, pluralized FQN (FQNs) and AAV (AAVs).
Authorization Documentation
docs/components/authorization.md
Replaced placeholder Registered Resource Value FQNs with concrete examples and changed labels from "EXPERIMENTAL" to "DEPRECATED".
Policy Documentation
docs/components/policy/index.md, docs/components/policy/attributes.md, docs/components/policy/registered_resources.md
Added namespacing details: optional namespace on Registered Resources, new namespaced FQN format https://<namespace>/reg_res/<registered_resource.name>/value/<registered_resource_value.value>, deprecation of non‑namespaced FQNs, deletion cascade semantics, NamespacedPolicy behavior, updated examples, and documented otdfctl migrate registered-resources with modes and warnings.
SDK Documentation
docs/sdks/policy.mdx
Clarified that a namespace optionally contains registered resources in addition to attributes.
API Spec
specs/policy/selectors.openapi.yaml
Added new OpenAPI schema component policy.SortDirection (enum: SORT_DIRECTION_UNSPECIFIED, SORT_DIRECTION_ASC, SORT_DIRECTION_DESC).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 I hopped through docs and changed some names,
FQNs found homes and namespaces claim their aims,
AAVs and FQNs now plural and bright,
Migration maps guide the moonlit night,
A tiny rabbit cheers the tidy sight!

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and specifically summarizes the main change: documenting the deprecation of non-namespaced registered resources, which aligns with the core purpose of the PR as described in the objectives.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch DSPX-2496-rr-ns

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (4)
docs/components/policy/registered_resources.md (1)

1-1: ⚠️ Potential issue | 🟡 Minor

Switch this modified policy page to .mdx format.

This file is updated as .md, which conflicts with the documentation format rule.

As per coding guidelines, **/*.{md,mdx}: Documentation files should use .mdx format; name new pages kebab-case.mdx, and use index.mdx for section landing pages.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@docs/components/policy/registered_resources.md` at line 1, This documentation
page is currently saved as a .md file but must follow the project's docs rule to
use .mdx; rename the file from registered_resources.md to kebab-case .mdx (e.g.,
registered-resources.mdx) or, if this is a section landing page, to index.mdx
inside a folder, and update any internal frontmatter or import usage to the .mdx
filename; ensure the top-level heading "Registered Resources" remains and that
the file extension and name follow the repository's .mdx naming conventions.
docs/components/policy/attributes.md (1)

1-1: ⚠️ Potential issue | 🟡 Minor

Convert this updated doc page to .mdx.

The file is modified as .md, but the documentation convention requires .mdx.

As per coding guidelines, **/*.{md,mdx}: Documentation files should use .mdx format; name new pages kebab-case.mdx, and use index.mdx for section landing pages.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@docs/components/policy/attributes.md` at line 1, The doc page titled
"Attributes" is currently written as a .md file; rename and convert it to a .mdx
file using the docs convention (use kebab-case for new page names, e.g.,
attributes.mdx) or if this is a section landing page turn it into index.mdx, and
ensure the file content is valid MDX (retain the "Attributes" heading and any
frontmatter) so it follows the **/*.{md,mdx} documentation guideline.
docs/components/authorization.md (1)

1-3: ⚠️ Potential issue | 🟡 Minor

Use .mdx for this documentation page.

This file is being modified as Markdown (.md), but docs standards require .mdx for documentation files.

As per coding guidelines, **/*.{md,mdx}: Documentation files should use .mdx format; name new pages kebab-case.mdx, and use index.mdx for section landing pages.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@docs/components/authorization.md` around lines 1 - 3, The documentation page
"authorization.md" is in the wrong format; rename and convert it to MDX by
changing the filename to a kebab-case .mdx (e.g., authorization.mdx) or to
index.mdx if this is a section landing page, update frontmatter and any
MD-specific constructs to MDX-compatible syntax, and ensure the docs
build/config references the new .mdx file instead of the .md file.
docs/components/policy/index.md (1)

1-4: ⚠️ Potential issue | 🟡 Minor

Please migrate this updated policy doc to .mdx.

The changed page remains .md, which conflicts with the docs file-format rule.

As per coding guidelines, **/*.{md,mdx}: Documentation files should use .mdx format; name new pages kebab-case.mdx, and use index.mdx for section landing pages.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@docs/components/policy/index.md` around lines 1 - 4, The file
docs/components/policy/index.md is still in .md and needs to be migrated to
.mdx: rename the page to use .mdx (use index.mdx for this section landing page)
and move/convert any frontmatter or markdown content into the new .mdx file
while preserving the existing YAML frontmatter fields (sidebar_position and
slug) or converting them to MDX-compatible export metadata; ensure the filename
follows the docs rule (section landing pages use index.mdx) and update any
internal imports/links that referenced docs/components/policy/index.md to point
to docs/components/policy/index.mdx.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@docs/components/authorization.md`:
- Around line 1-3: The documentation page "authorization.md" is in the wrong
format; rename and convert it to MDX by changing the filename to a kebab-case
.mdx (e.g., authorization.mdx) or to index.mdx if this is a section landing
page, update frontmatter and any MD-specific constructs to MDX-compatible
syntax, and ensure the docs build/config references the new .mdx file instead of
the .md file.

In `@docs/components/policy/attributes.md`:
- Line 1: The doc page titled "Attributes" is currently written as a .md file;
rename and convert it to a .mdx file using the docs convention (use kebab-case
for new page names, e.g., attributes.mdx) or if this is a section landing page
turn it into index.mdx, and ensure the file content is valid MDX (retain the
"Attributes" heading and any frontmatter) so it follows the **/*.{md,mdx}
documentation guideline.

In `@docs/components/policy/index.md`:
- Around line 1-4: The file docs/components/policy/index.md is still in .md and
needs to be migrated to .mdx: rename the page to use .mdx (use index.mdx for
this section landing page) and move/convert any frontmatter or markdown content
into the new .mdx file while preserving the existing YAML frontmatter fields
(sidebar_position and slug) or converting them to MDX-compatible export
metadata; ensure the filename follows the docs rule (section landing pages use
index.mdx) and update any internal imports/links that referenced
docs/components/policy/index.md to point to docs/components/policy/index.mdx.

In `@docs/components/policy/registered_resources.md`:
- Line 1: This documentation page is currently saved as a .md file but must
follow the project's docs rule to use .mdx; rename the file from
registered_resources.md to kebab-case .mdx (e.g., registered-resources.mdx) or,
if this is a section landing page, to index.mdx inside a folder, and update any
internal frontmatter or import usage to the .mdx filename; ensure the top-level
heading "Registered Resources" remains and that the file extension and name
follow the repository's .mdx naming conventions.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d4d78d79-1ebf-47b7-8c5e-68d0566c3fda

📥 Commits

Reviewing files that changed from the base of the PR and between 70d68f6 and 28abb3a.

📒 Files selected for processing (6)
  • .github/vale-styles/config/vocabularies/Opentdf/accept.txt
  • docs/components/authorization.md
  • docs/components/policy/attributes.md
  • docs/components/policy/index.md
  • docs/components/policy/registered_resources.md
  • docs/sdks/policy.mdx

When a Registered Resource is associated with a namespace, the FQN takes the form `https://<namespace>/reg_res/<registered_resource.name>/value/<registered_resource_value.value>`.

:::warning Deprecation
Non-namespaced Registered Resources are deprecated. Their FQNs use the form `https://reg_res/<registered_resource.name>/value/<registered_resource_value.value>`. A future version will require all Registered Resources to be associated with a namespace. Use the `otdfctl migrate registered-resources` command to migrate existing non-namespaced Registered Resources.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are they deprecated? Or do we just recommend that you don't create non-namespaced RRs?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought we were deprecating non namespaced policy (like why we originally made namespaces required for some policy objects). My understanding was that due to breaking changes we were making namespaces optional to give consumers a grace period and avoid breaking changes. I may have understood incorrectly, or my understanding may be outdated? I'll reach out to the team for clarification.

The `otdfctl migrate registered-resources` command migrates legacy non-namespaced Registered Resources to namespaced ones.

:::caution
Migration creates a new namespaced resource, recreates its values with their action-attribute-value mappings, then deletes the old non-namespaced resource. The migrated resource will have a new UUID. Back up your data before running with `--commit`.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we are changing this to not delete the old, but add a metadata tag that we can then use with a prune or cleanup command.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, what would you recommend? I'm thinking I can keep this block as current behavior but mention future expected behavior. Alternatively, I can just remove mention of migration until we get to an expected state.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants