sync a58faaa refactor(authz)

deploy/config/opa/authz.yml

@@ -6,9 +6,10 @@
 #     ./scripts/sicabe-authz render        # authz.yml -> data.json
 #     ./scripts/sicabe-authz apply         # render + reload OPA
 #     ./scripts/sicabe-authz fmt           # rapikan format berkas ini
-# Policy Rego membaca data.authz.catalogs / data.authz.write_schemas — nama
-# catalog/schema TIDAK di-hardcode di Rego. Ganti nama catalog = ubah `catalogs:`
-# di sini -> render -> reload. Dokumentasi: docs/authorization-cli.md
+# Policy Rego membaca data.authz.catalogs + grant schema (data.roles.<r>.schema_grants)
+# — nama catalog/schema & cakupan GRANT TIDAK di-hardcode di Rego. Ganti nama
+# catalog = ubah `catalogs:` di sini -> render -> reload. Grant tingkat-schema:
+# `roles.<r>.schemas: [{schema, caps, columns}]`. Dokumentasi: docs/authorization-cli.md
 # =============================================================================
 version: 1
 catalogs: [iceberg]
@@ -29,6 +30,16 @@ roles:
     - table: gold.orders_gold
       caps: [select, write, ddl]
       columns: '*'
+    schemas:
+    - schema: bronze
+      caps: [select, write, ddl]
+      columns: '*'
+    - schema: silver
+      caps: [select, write, ddl]
+      columns: '*'
+    - schema: gold
+      caps: [select, write, ddl]
+      columns: '*'
   data-catalog:
     grants:
     - table: bronze.orders