Scoped MANAGE_GRANTS in Gravitino — equivalent of SQL WITH GRANT OPTION

[bharos]

Context

Considering the path of migrating from Hive SQL Standard Based Authorization to Gravitino's access control model.
One of the features we rely on in Hive is WITH GRANT OPTION, which allows a user to delegate
the ability to grant a specific privilege on a specific object to others:

GRANT SELECT ON TABLE finance.orders TO USER alice WITH GRANT OPTION;
-- Alice can now grant SELECT on finance.orders to other users/roles

Gravitino has MANAGE_GRANTS as the closest concept, but after reviewing the source code I
found it is fundamentally metalake-wide and cannot be scoped to a catalog, schema, or table:

Privileges.ManageGrants.canBindTo() only returns true for MetadataObject.Type.METALAKE

hasMetadataPrivilegePermission() in JcasbinAuthorizer only checks MANAGE_GRANTS against the metalake object, not the target object's ancestor hierarchy

grantRolesToUser and grantPrivilegesToRole in PermissionOperations have hardcoded
@AuthorizationExpression(expression = "METALAKE::OWNER || METALAKE::MANAGE_GRANTS") , so even if the above were fixed, role assignment still requires metalake-level authority.

I also explored object ownership as a workaround — the owner of a parent object (e.g. schema)
can grant privileges on children — but:

• Only one USER can own an object (GROUP ownership is not yet supported)
• Ownership grants full ALL access to the object, not just grant-delegation authority (also this can just be single user, can't make a bunch of users as owners)

Questions:
Is scoped MANAGE_GRANTS something reasonable to support?
Or is there a recommended workaround today beyond centralizing all grant management through metalake admins?

[roryqi]

Two solutions:

We add a new privilege property like GRANT_OPTION
MANAGE_GRANTS to object level.
Option 2 won't add new concepts. It may be easier for understanding.
Option 1 could be more restricted.

I prefer option 2.

[bharos]

Update : #10294 has been resolved, we have added scoped managed grants, which allows users to MANAGE_GRANTS at object level (schema/table/catalog etc..)