[github-actions]

🤖 I have created a release beep boop

0.1.0 (2026-10-22)

⚠ BREAKING CHANGES

• privileged roles are held only by identities and privileged groups, and tenant admins change group members (#22)
• Holders lists people a deny on their group binds, and drops conditional grants an access review needs (#21)
• checks resolve a subject's memberships and groups, which Subject no longer carries (#20)

Features

• AsOf reads a tenant as it was at a time (#25) (ca195bb)
• checks resolve a subject's memberships and groups, which Subject no longer carries (#20) (c459c95)
• every change to the package's tables is recorded, and History exports it in order (#23) (0d165bb)
• exclusive label values, held one at a time (#31) (eeedd63)
• Export chains history's records and signs checkpoints, which VerifyChain checks (#28) (fae3ecd)
• history records who made each change, how, and the host's request and reason (#24) (d92f974)
• labeled data is written under a label as restrictive, and loosened only by a release (#30) (dd41b0a)
• labels on data, a mandatory layer above every grant (#29) (07de765)
• one type of group, whose members change as granting what it holds (#32) (73720a2)
• OnRefused is told of every change refused, to record the failed attempt (#26) (f1c29f9)
• privileged roles are held only by identities and privileged groups, and tenant admins change group members (#22) (0836301)
• PruneHistory deletes what an export read past, keeping what AsOf reads (#27) (1d64bc1)
• role-based access control on PostgreSQL (#3) (3311c73)
• tenants' memberships and groups are stored by the package (#17) (faa0ad1)

Bug Fixes

• a change in a tenant whose members are in groups reads every membership in the tenant (#38) (e52e4e4)
• a change to exclusive values reads every value held in its tenant, and DeleteExpired deletes everything in one transaction (#37) (1608e38)
• a change, Holders or AsOf naming a small group reads every member of the tenant's other groups (#40) (beb42a4)
• a check of a labeled resource asks the constraints about every label value the subject holds, and fails when a hook fails on a value its label doesn't name (#78) (3488e9e)
• a condition building a message holds a check for seconds or crashes the process on a value that holds itself, and looking up a long key or reading a time in a long zone takes far longer than it is charged (#81) (ce6c6b1)
• a condition looping over a long list or map the host passes takes far longer than it is charged, and a loop whose steps read only literals costs nothing for each element (#71) (d0dbc19)
• a deny below the tenant doesn't stop redefining or deleting a custom role granted under it, nor a deny or label widening one a role granted there lists, and Grantable, Apply and searches take seconds with large custom roles (#66) (ebdb8e0)
• a deny lifts where a condition keys a map by NaN, converts NaN to a string, or compares a host's map or optional holding it (#84) (9bc724d)
• a deny testing whether an attribute is present is lifted when the host passes it as nil or another type, and one change can compile a thousand conditions (#42) (7ca3c7e)
• a deny that exempts the public, or a tenant's members, binds no one (#9) (4d9eae2)
• a few long conditional denies deny everyone they name, and conditional grants decide by their ids (#13) (aca1919)
• a freeze on a type's grants doesn't stop deleting or redefining a custom role narrowed off it, widening one asks the host about every scope it is granted on for an actor cleared for every label, and redefining or deleting one reads every grant, eligibility or deny in the tenant (#74) (02cb008)
• a group manager without a labeled scope's label could bind members to a deny there by adding them to a group it names, or end their activations there by removing them once the eligibility was gone, DeleteGroup ended such activations, and a place made again read as made by its old creator (#73) (c27b25c)
• a label value is decided on tenant attributes labeled checks don't read and can be handed on by an actor who can't use it, redefining a role can pass the per-value condition bound, DeleteRole asks the host about every scope, and Explain names no exclusive refusal (#58) (1680129)
• a misspelled permission or resource type is denied instead of refused as invalid (#7) (8a4e7d9)
• a tenant's admin can grant and revoke grants from the host's own sources (#12) (29d5e90)
• access held only for a while can be granted on for good, a revoked clearance doesn't stop a change in progress, and a misspelled deny or removal succeeds having done nothing (#48) (dbc360b)
• Activate and Import tell ValidateGrant a role that hands out a privileged custom role isn't privileged (#5) (d1ecd16)
• activating through groups that converge and fan out again takes seconds, DeleteGroup refuses a group whose host places have ended, and the bounds overstate what limits the groups a check reads (#64) (9141e13)
• activations outlasting their eligibility, hand-on under subject conditions, and host answers that changed before a change commits (#34) (f25c9cd)
• adding many members to a group with access on many scopes builds a binding and asks the host for every member on every scope without bound, and MembershipsOf and GroupsOf don't say they have no limit or cursor (#77) (72c3c5b)
• an activation outlives leaving the group it was made through, can be made through a place nested meanwhile, and ending a place reads every activation in the tenant (#56) (10b5d84)
• an actor a constraint keeps from a permission can still hand it on (#10) (e964711)
• an infinite expiry stops history's export, a revoke in an older transaction is dated before its grant, and pruning and AsOf read all of history (#35) (03734b1)
• as of a time, a check rereads every version of the tenant's custom roles for each it reads and lists read the tenant's whole history, Filter keeps a denied resource whose path starts from 0, and lists of tenants by a label value apply the tenant's label (#68) (05abbfb)
• as of a time, a deny stored with its keys in two dimensions binds no one, AsOf reads hours away from its time or a time already pruned under some TimeZone settings, and the README bounds History's wait with timeouts any session can turn off (#72) (b389122)
• as of a time, a revoke a procedure or DO block makes after it commits counts from before moments it came after, migrating deadlocks with a change reading the tables in another order, the README's role setup fails every call, and AsOf panics on a nil read (#79) (4d73598)
• changing a group's members can give grants the host never approved, and an ended membership can keep a place in a group (#44) (0d5a440)
• changing a group's members reads every eligibility and deny in the tenant, and checks' denies, lists, Activate, writes and group walks read the whole tenant once statements turn generic (#52) (f7b885f)
• checks and changes allow a labeled resource no single moment allowed, an actor can't hand on a label value a deny reading the tenant's id leaves it, Holders of a labeled resource takes seconds, and a note-only grant change is refused for exclusive values (#67) (918019a)
• checks, lists and changes allow what no moment allowed when a grant or membership expires as they run, and the docs misstate how label values are read and who can hand on an exclusive value (#75) (0ae3c42)
• checks, lists and revokes slow down by orders of magnitude once a connection's statements turn generic, and changes through another search_path don't wait for each other (#46) (5fb6194)
• conditions are false for attributes passed as another type, and can't run longer than their cost (#33) (54d4da9)
• conditions comparing an attribute with the subject's id are bounded as the costliest, and a map attribute named as another's entries fails New with a protobuf error (#63) (45aac9a)
• conditions looping over what map() or filter() make are bounded as the costliest, and ones reading dyn() values cost past their bounds (#59) (74e0a12)
• deleting a container's many scopes in one transaction can fill PostgreSQL's lock table (#8) (ee3aba5)
• deps: builds use Go 1.27.2, whose crypto/x509 has a known vulnerability (#69) (37d121b)
• errors.Is and errors.As can't find the host's own error in a grant ValidateGrant refused (#6) (e4e4ebb)
• Filter and Reachable read every grant a subject holds to find its grants on containers (#14) (b1cab5f)
• Filter keeps another tenant's rows in a case-insensitive collation, Holders lists no one under a constraint on the subject, and a check can mix a grant and its role from two moments (#36) (6029dcd)
• grants a third party adds can stop a conditional grant it can't revoke from giving anything, a labeled check evaluates each condition once per value, and conditions under changed declarations or NaN doubles fail open (#53) (b38319c)
• grants ending apart or on many scopes walk the roles they list for each, shortening a place is checked as a join, two tenants can share a lock, removals fail on a group the host lost, and an identity's groups are unbounded (#62) (c5d32bb)
• History and Export can read and sign a session's temporary table as history, and AsOf reads rows made before history as never existing (#45) (17707d8)
• Holders can leave out the tenant's members or the public, and a change can be refused, by reading custom roles at another moment than grants (#39) (400568c)
• Holders lists people a deny on their group binds, and drops conditional grants an access review needs (#21) (a1f59a7)
• Holders lists the tenant's members or the public for a labeled resource none of them can pass (#43) (af0e785)
• joining a tenant suspended can leave an identity able to hold two exclusive values (#47) (49612bd)
• labels don't stop removing members or managing a labeled group, shortening a place needs the power to grant, and large member and grant changes are slow (#55) (0b56fa5)
• leaving a tenant or a group keeps exemptions, approvals and activations it gave, deleting a group can lift a deny set meanwhile, and some removals deadlock (#50) (a702203)
• list pages slow with the square of a subject's grants on containers, denies on thousands of containers slow every list in the tenant, and the docs advise a label index that serves nothing (#54) (c3cafeb)
• lists read every deny in the tenant and leave the path's index for grants that give nothing, and deletions, changes naming a group and Holders of exclusive labels read whole tenants (#57) (25bab00)
• Memberships of named principals, SetMemberships, DeleteExpired, deleting a group and exclusive-value checks read whole tenants or tables once statements turn generic (#51) (14b017c)
• migrating on a host's REPEATABLE READ transaction records rows as they were, a deny joining two permissions in one element binds no one, baselines can be dated where no export can write them, and AsOf slows with every prune and can hang rolling back (#49) (1142398)
• migrating where standard_conforming_strings is off refuses every deny and weakens the custom role id check, the tables take conditions longer than the package writes, and the README misses prepared transactions and two superuser-equivalent privileges (#65) (15c13f9)
• one row written around the package stops every export, one History call can load gigabytes, and a prune reads all of history in one transaction (#60) (38c5078)
• redefining a custom role widens grants already made without asking ValidateGrant (#11) (b5de75f)
• renaming or narrowing a custom role is refused for an exclusive conflict it found, a grant whose condition shares a stored one's length and hash is dropped as made, a refusal is dated after its change ended, and the docs misstate who may rename a role and what a container takes (#80) (bae7dfe)
• searches read every grant of a custom role in the tenant once planned generically, and as of a time lists read every version of every deny on their types and searches and Grantable every version of every custom role (#76) (57b1485)
• searches read every grant to the tenant's members and the public on the listed types even for the anonymous and guests, read each grant's row, and as of a time read every version of grants they don't count or of other types, and checks every version of their subject's grants (#82) (e37c62c)
• two changes at once each ending one of an activation's paths leave it standing, revoking activations deadlocks with ending them, and an approver without a labeled scope's values approves activations on it (#61) (915e1ba)
• writing or deleting many rows in one statement takes time growing with the square of their number (#83) (176c533)

---

This PR was generated with Release Please. See documentation.