Version-Level Policy Cascade and Default-Deny Configuration (issue 20 of 29)

Labels: ready-to-code
Depends on: Issue 3 (#4041 permission definitions)
RHIDP Stories: RHIDP-15275, RHIDP-15306 (implementation)
Feature: RHDHPLAN-1508 — Epics RHIDP-15274, RHIDP-15270

Create AICatalogRBACProvider implementing the RBACProvider interface via rbacProviderExtensionPoint, with asset→version policy cascade propagation, event-driven refresh() with debouncing, and policyDecisionPrecedence config for version-specific override ordering. Implement default-deny configuration with global, per-category, and per-connector posture scoping, rhdh.io/ai-catalog-ingested-at annotation stamping, and startup validation.

Tasks

From openspec/changes/ai-catalog-asset-governance/tasks.md group 5 (RHIDP-15274, RHIDP-15275):

• 5.1 Create AICatalogRBACProvider implementing RBACProvider interface
• 5.2 Register provider via rbacProviderExtensionPoint
• 5.3 Implement asset→version relationship discovery
• 5.4 Implement applyConditionalPermissions() propagation from asset to version entities
• 5.5 Implement event-driven refresh() with debouncing
• 5.6 Handle edge cases: orphan versions, asset deletion, no-version assets
• 5.7 Support policyDecisionPrecedence config for version-specific override ordering
• 5.8 Add unit tests for cascade propagation, override precedence, and edge cases

From openspec/changes/ai-catalog-asset-governance/tasks.md group 6 (RHIDP-15306):

• 6.1 Add ai-catalog.rbac.defaultPolicy config schema (allow|deny, default: allow)
• 6.2 Add per-category config schema
• 6.3 Add per-connector config schema
• 6.4 Implement catch-all DENY conditional rule for deny-posture entities
• 6.5 Implement rhdh.io/ai-catalog-ingested-at annotation stamping at ingestion time
• 6.6 Implement configuration validation at startup
• 6.7 Add unit tests for default-deny posture
• 6.8 Persist policy-change timestamp (via AdminConfigService.setOverride()) when admin changes default posture; read in AICatalogRBACProvider.refresh() to compare against rhdh.io/ai-catalog-ingested-at

Specifications

• openspec/changes/ai-catalog-asset-governance/specs/version-policy-cascade/spec.md
• openspec/changes/ai-catalog-asset-governance/specs/default-deny-config/spec.md

Read openspec/changes/ai-catalog-asset-governance/tasks.md and the version-policy-cascade/spec.md and default-deny-config/spec.md first. Trace the RBACProvider interface and rbacProviderExtensionPoint, then implement the listed cascade, refresh, configuration, annotation, validation, and timestamp behavior with tests covering propagation, precedence, edge cases, and default-deny posture.