Sema Policy Engine ↔ Spring Security 6: Compatibility and Nested Policy Evaluation Order

Integration Overview

Developers often embed the Sema Policy Engine into Spring‑based microservices by registering a SemaPolicyResolver bean and wiring a custom PolicyFilter into the SecurityFilterChain. The filter intercepts each request and delegates authorization decisions to Sema’s PolicyResolver.

Version Compatibility Constraints

Sema 1.2 officially supports Java 11 and Java 17, yet its release notes do not explicitly confirm compatibility with the Java 17 module system. This omission raises uncertainty about runtime module visibility and potential ClassNotFoundException scenarios when Sema classes are not exported to the application module.

Unresolved Nested Policy Evaluation Behavior

When a policy references another policy (nested policies), Sema’s current implementation lacks a deterministic evaluation order. Consequently, complex policy trees may produce inconsistent authorization outcomes across repeated evaluations, potentially leading to race conditions in high‑concurrency environments.

Key Questions

• Does Sema 1.2 expose its core policy classes in a way that satisfies Java 17 module visibility requirements when used in a modular Spring Boot application?
• What mechanism, if any, can be applied to enforce a deterministic evaluation order for nested policies within Sema?
• Are there known workarounds or configuration flags in Spring Security 6 that mitigate nondeterministic policy evaluation when integrating with Sema?