[viethqb]

Summary

This PR documents egret-data/platform#838, governance SP2b 2b-1: Trino on OPA (preview). In this preview, egret answers Trino's OPA access-control plugin itself. The feature is turned on per profile and is off by default.

Changes

• New page: platform/data-governance/engines-and-policy/trino-on-opa.md. It covers:
  • enabling the feature ([governance.opa] enabled, which also needs ranger.enabled);
  • which profiles and engines qualify, with every refusal message;
  • the PATCH …/policies/services/{service} switch, including its 200, 409 and 502 answers and how to retry;
  • provisioned versus external engines;
  • GET /engines/{id}/opa-plugin-config;
  • credentials and rotation;
  • network exposure of /opa/;
  • limits: the 4 MiB body limit, one batch per schema, and the parse semaphore;
  • freshness and fail-closed behaviour;
  • how OPA decisions differ from Ranger: the five explained differences, where OPA is never looser;
  • explain;
  • observability;
  • known gaps.
• deploy-operate/upgrade.md: a version note for #838. Migration 0213 adds mechanism with a default of ranger, so nothing changes until the gate is turned on.
• reference/configuration-keys.md: a new governance.opa section.
• engines-and-ranger.md: a pointer to the new page.

This PR covers the API and config only. UI steps, screenshots and latency numbers come with 2b-2.

🤖 Generated with Claude Code